Initial chezmoi-managed dotfiles with bootstrap scripts

- Rename master to legacy-2025 on remote (frozen pre-chezmoi snapshot)
- New orphan 'main' branch with bootstrap-enabled config
- .chezmoi.yaml.tmpl detects os_family (debian | arch) from /etc/os-release
- dot_zshrc.tmpl refactored from current miche config with os_family
  conditional for pacman vs apt aliases
- dot_config/: bat, btop, ghostty (with gruvbox themes), kitty (with gruvbox
  colors), nvim (LazyVim), paru
- dot_gitconfig.tmpl, dot_tmux.conf (verbatim from current state)
- run_once_00-install-bootstrap-tools.sh.tmpl: age, git, curl, ca-certificates
- run_once_10-add-chaotic-aur.sh.tmpl (arch-only): add Chaotic-AUR + install paru
- run_once_20-install-user-packages.sh.tmpl: zsh, tmux, neovim (with version
  check + binary tarball fallback for debian), oh-my-zsh + plugins, tpm,
  rustup, all CLI tools
- run_onchange_30-ensure-cargo.sh.tmpl: rustup fallback
- README.md with onboarding runbook

.chezmoi.yaml.tmpl

@@ -0,0 +1,18 @@
+{{- $osFamily := "unknown" -}}
+{{- if eq .chezmoi.osRelease.idLike "arch" -}}
+{{- $osFamily = "arch" -}}
+{{- else if or (eq .chezmoi.osRelease.id "debian") (eq .chezmoi.osRelease.idLike "debian") -}}
+{{- $osFamily = "debian" -}}
+{{- end -}}
+encryption: "age"
+sourceDir: {{ .chezmoi.sourceDir | quote }}
+
+# When you have age secrets, uncomment and add recipient public keys here.
+# recipients:
+#   - age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p
+#   - age1miche_pubkey_placeholder
+#   - age1byte_pubkey_placeholder
+
+data:
+    os_family: {{ $osFamily | quote }}
+    os_id: {{ .chezmoi.osRelease.id | quote }}