Initial chezmoi-managed dotfiles with bootstrap scripts

- Rename master to legacy-2025 on remote (frozen pre-chezmoi snapshot)
- New orphan 'main' branch with bootstrap-enabled config
- .chezmoi.yaml.tmpl detects os_family (debian | arch) from /etc/os-release
- dot_zshrc.tmpl refactored from current miche config with os_family
  conditional for pacman vs apt aliases
- dot_config/: bat, btop, ghostty (with gruvbox themes), kitty (with gruvbox
  colors), nvim (LazyVim), paru
- dot_gitconfig.tmpl, dot_tmux.conf (verbatim from current state)
- run_once_00-install-bootstrap-tools.sh.tmpl: age, git, curl, ca-certificates
- run_once_10-add-chaotic-aur.sh.tmpl (arch-only): add Chaotic-AUR + install paru
- run_once_20-install-user-packages.sh.tmpl: zsh, tmux, neovim (with version
  check + binary tarball fallback for debian), oh-my-zsh + plugins, tpm,
  rustup, all CLI tools
- run_onchange_30-ensure-cargo.sh.tmpl: rustup fallback
- README.md with onboarding runbook

README.md

@@ -0,0 +1,96 @@
+# gnu-plus-dotfiles
+
+Chezmoi-managed dotfiles synced across all your linux boxes.
+Source of truth: `~/.local/share/chezmoi` on your main workstation.
+Remote: `ssh://git@git.melonbread.xyz/rain/gnu-plus-dotfiles.git`
+
+## Branches
+
+- `main` — current, bootstrap-enabled. All active work.
+- `legacy-2025` — frozen snapshot of the pre-chezmoi-bootstrap config. Read-only.
+
+## What's in here
+
+```
+.chezmoi.yaml.tmpl              os_family detection (debian | arch)
+dot_zshrc.tmpl                  zsh config with os_family-conditional aliases
+dot_tmux.conf                   tmux + tpm + gruvbox plugin stack
+dot_gitconfig.tmpl              git + delta
+dot_config/
+  bat/                          bat config
+  btop/                         btop theme + options
+  ghostty/                      ghostty terminal + gruvbox themes
+  kitty/                        kitty terminal + gruvbox themes
+  nvim/                         LazyVim + custom plugins
+  paru/                         (arch-only) paru config
+
+run_once_00-install-bootstrap-tools.sh.tmpl
+run_once_10-add-chaotic-aur.sh.tmpl            (arch-only)
+run_once_20-install-user-packages.sh.tmpl
+run_onchange_30-ensure-cargo.sh.tmpl
+```
+
+## Onboarding a new box
+
+On a fresh debian-stable or arch-base install:
+
+```bash
+# 1. Install chezmoi binary itself (one-time, before this repo's run_once runs)
+sh -c "$(curl -fsSL get.chezmoi.io)" -- -b "$HOME/.local/bin"
+
+# 2. Initialize from your repo
+chezmoi init --apply ssh://git@git.melonbread.xyz/rain/gnu-plus-dotfiles.git
+
+# 3. The bootstrap scripts run automatically. They will:
+#    - install age, git, curl (run_once_00)
+#    - on arch: add Chaotic-AUR + install paru (run_once_10)
+#    - install zsh, tmux, neovim, oh-my-zsh, all CLI tools (run_once_20)
+#    - install rustup if cargo missing (run_onchange_30)
+
+# 4. Reboot or `exec zsh` to start using the new shell
+exec zsh
+```
+
+The first run will take a few minutes (downloading packages, cloning oh-my-zsh plugins, tpm, LazyVim plugins via nvim).
+
+## Adding age encryption (when you have secrets)
+
+```bash
+# On your main workstation:
+mkdir -p ~/.config/chezmoi/keys
+age-keygen -o ~/.config/chezmoi/keys/recovery.key
+# Save the printed secret key in your password manager.
+
+# On each machine, generate a per-machine identity:
+age-keygen -o ~/.config/chezmoi/key.txt
+# Paste the public key back to your main workstation.
+
+# In .chezmoi.yaml.tmpl, uncomment and fill the recipients block, then:
+chezmoi age rekey
+```
+
+## Editing dotfiles
+
+```bash
+chezmoi edit ~/.zshrc          # opens in $EDITOR, auto-applies on save
+chezmoi diff                   # see what's pending
+chezmoi apply                  # apply pending changes
+chezmoi cd                     # jump to the source repo
+```
+
+From inside `~/.local/share/chezmoi`, you can `git status`, `git diff`, `git push` like any normal repo.
+
+## Common gotchas
+
+- **Neovim too old on Debian**: `run_once_20` detects this and installs the official binary. If you see "Edit: command not found" inside LazyVim, neovim <0.9.
+- **zsh plugins not loading**: check `~/.oh-my-zsh/custom/plugins/` exists. Bootstrap installs them.
+- **paru 404 on arch**: Chaotic-AUR mirrors occasionally lag. Re-run `sudo pacman -Syu` then `chezmoi apply`.
+- **fastfetch not running**: command not found, install via package manager. Debian needs `apt install fastfetch` (bookworm+).
+- **`Maple Mono NF` font warning in nvim**: set `vim.opt.guifont` in `~/.config/nvim/lua/local.lua` (not in chezmoi).
+
+## Out of scope (intentionally not in repo)
+
+- `~/.config/zsh/functions.zsh` — host-specific (reads `~/AI/llama.cpp/key.txt`). Recreate per host.
+- KDE plasma configs (kwinrc, kdeglobals, etc.) — live state, varies wildly per host.
+- Alacritty, foot, fish — not in use, drop if you want.
+- mpv, topgrade, mako — out of scope unless re-added.