Initial chezmoi-managed dotfiles with bootstrap scripts

- Rename master to legacy-2025 on remote (frozen pre-chezmoi snapshot)
- New orphan 'main' branch with bootstrap-enabled config
- .chezmoi.yaml.tmpl detects os_family (debian | arch) from /etc/os-release
- dot_zshrc.tmpl refactored from current miche config with os_family
  conditional for pacman vs apt aliases
- dot_config/: bat, btop, ghostty (with gruvbox themes), kitty (with gruvbox
  colors), nvim (LazyVim), paru
- dot_gitconfig.tmpl, dot_tmux.conf (verbatim from current state)
- run_once_00-install-bootstrap-tools.sh.tmpl: age, git, curl, ca-certificates
- run_once_10-add-chaotic-aur.sh.tmpl (arch-only): add Chaotic-AUR + install paru
- run_once_20-install-user-packages.sh.tmpl: zsh, tmux, neovim (with version
  check + binary tarball fallback for debian), oh-my-zsh + plugins, tpm,
  rustup, all CLI tools
- run_onchange_30-ensure-cargo.sh.tmpl: rustup fallback
- README.md with onboarding runbook

run_once_00-install-bootstrap-tools.sh.tmpl

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# =============================================================================
+#  run_once_00-install-bootstrap-tools.sh.tmpl
+#  Install age, curl, ca-certificates, git — needed before anything else.
+#  Idempotent: skips if already installed.
+# =============================================================================
+set -euo pipefail
+
+log() { printf '\033[1;34m[bootstrap]\033[0m %s\n' "$*"; }
+die() { printf '\033[1;31m[bootstrap ERROR]\033[0m %s\n' "$*" >&2; exit 1; }
+
+[[ "$(id -u)" -ne 0 ]] && die "must run as root or via sudo"
+
+{{ if eq .os_family "arch" -}}
+log "pacman-sync"
+pacman -Sy --noconfirm
+
+log "install base tools (arch)"
+PACMAN_PKGS=(age curl ca-certificates git base-devel wget)
+pacman -S --needed --noconfirm "${PACMAN_PKGS[@]}"
+
+{{ else if eq .os_family "debian" -}}
+export DEBIAN_FRONTEND=noninteractive
+log "apt-update"
+apt-get update -y
+log "apt-upgrade"
+apt-get upgrade -y
+
+log "install base tools (debian)"
+APT_PKGS=(age curl ca-certificates git wget gnupg)
+apt-get install -y --no-install-recommends "${APT_PKGS[@]}"
+
+{{ else -}}
+die "unsupported os_family: {{ .os_family }} (this script supports arch or debian)"
+{{ end -}}
+
+log "bootstrap tools installed"
+command -v age && age --version
+command -v git && git --version