Initial chezmoi-managed dotfiles with bootstrap scripts

- Rename master to legacy-2025 on remote (frozen pre-chezmoi snapshot)
- New orphan 'main' branch with bootstrap-enabled config
- .chezmoi.yaml.tmpl detects os_family (debian | arch) from /etc/os-release
- dot_zshrc.tmpl refactored from current miche config with os_family
  conditional for pacman vs apt aliases
- dot_config/: bat, btop, ghostty (with gruvbox themes), kitty (with gruvbox
  colors), nvim (LazyVim), paru
- dot_gitconfig.tmpl, dot_tmux.conf (verbatim from current state)
- run_once_00-install-bootstrap-tools.sh.tmpl: age, git, curl, ca-certificates
- run_once_10-add-chaotic-aur.sh.tmpl (arch-only): add Chaotic-AUR + install paru
- run_once_20-install-user-packages.sh.tmpl: zsh, tmux, neovim (with version
  check + binary tarball fallback for debian), oh-my-zsh + plugins, tpm,
  rustup, all CLI tools
- run_onchange_30-ensure-cargo.sh.tmpl: rustup fallback
- README.md with onboarding runbook

run_once_10-add-chaotic-aur.sh.tmpl

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# =============================================================================
+#  run_once_10-add-chaotic-aur.sh.tmpl  (arch-only)
+#  Add Chaotic-AUR repo + keyring to pacman, then install paru from there.
+#  Reference: https://aur.chaotic.cx/docs
+#
+#  Steps from chaotic docs:
+#    1. Get and sign the key
+#    2. Install chaotic-keyring + chaotic-mirrorlist
+#    3. Append repo to /etc/pacman.conf
+# =============================================================================
+set -euo pipefail
+
+log() { printf '\033[1;34m[chaotic]\033[0m %s\n' "$*"; }
+die() { printf '\033[1;31m[chaotic ERROR]\033[0m %s\n' "$*" >&2; exit 1; }
+
+[[ "$(id -u)" -ne 0 ]] && die "must run as root or via sudo"
+
+if command -v paru >/dev/null 2>&1; then
+    log "paru already installed — skipping chaotic setup"
+    exit 0
+fi
+
+# Chaotic's official bootstrap. Run as root because pacman-key needs it.
+log "fetching chaotic key (3056513887B78AEB)"
+pacman-key --recv-key 3056513887B78AEB
+pacman-key --lsign-key 3056513887B78AEB
+
+log "installing chaotic-keyring and chaotic-mirrorlist"
+pacman -U --noconfirm \
+    'https://cdn-mirror.chaotic.cx/chaotic-aur/chaotic-keyring.pkg.tar.zst' \
+    'https://cdn-mirror.chaotic.cx/chaotic-aur/chaotic-mirrorlist.pkg.tar.zst'
+
+# Append chaotic repo to pacman.conf if not already present
+if ! grep -q "^\[chaotic-aur\]" /etc/pacman.conf; then
+    log "appending chaotic-aur to /etc/pacman.conf"
+    cat >> /etc/pacman.conf <<'PACMAN_EOF'
+
+[chaotic-aur]
+Include = /etc/pacman.d/chaotic-mirrorlist
+PACMAN_EOF
+else
+    log "chaotic-aur already in /etc/pacman.conf"
+fi
+
+log "full system sync with chaotic enabled"
+pacman -Syu --noconfirm
+
+log "installing paru from chaotic-aur"
+pacman -S --needed --noconfirm paru
+
+log "chaotic-aur + paru ready"
+paru --version