Initial chezmoi-managed dotfiles with bootstrap scripts

- Rename master to legacy-2025 on remote (frozen pre-chezmoi snapshot)
- New orphan 'main' branch with bootstrap-enabled config
- .chezmoi.yaml.tmpl detects os_family (debian | arch) from /etc/os-release
- dot_zshrc.tmpl refactored from current miche config with os_family
  conditional for pacman vs apt aliases
- dot_config/: bat, btop, ghostty (with gruvbox themes), kitty (with gruvbox
  colors), nvim (LazyVim), paru
- dot_gitconfig.tmpl, dot_tmux.conf (verbatim from current state)
- run_once_00-install-bootstrap-tools.sh.tmpl: age, git, curl, ca-certificates
- run_once_10-add-chaotic-aur.sh.tmpl (arch-only): add Chaotic-AUR + install paru
- run_once_20-install-user-packages.sh.tmpl: zsh, tmux, neovim (with version
  check + binary tarball fallback for debian), oh-my-zsh + plugins, tpm,
  rustup, all CLI tools
- run_onchange_30-ensure-cargo.sh.tmpl: rustup fallback
- README.md with onboarding runbook

run_once_20-install-user-packages.sh.tmpl

@@ -0,0 +1,131 @@
+#!/usr/bin/env bash
+# =============================================================================
+#  run_once_20-install-user-packages.sh.tmpl
+#  Install zsh, tmux, neovim, fastfetch, plus the modern CLI replacements
+#  the .zshrc aliases depend on (bat, btop, eza, fzf, fd, ripgrep, zoxide,
+#  starship, lazygit, yt-dlp, etc.)
+#
+#  Also: install oh-my-zsh, zsh-autosuggestions, zsh-syntax-highlighting,
+#  zsh-history-substring-search.
+#
+#  Runs as the unprivileged user, but uses sudo for system packages.
+# =============================================================================
+set -euo pipefail
+
+log() { printf '\033[1;34m[packages]\033[0m %s\n' "$*"; }
+die() { printf '\033[1;31m[packages ERROR]\033[0m %s\n' "$*" >&2; exit 1; }
+
+USER_HOME="${HOME:-$(eval echo "~$(whoami)")}"
+ZSH_CUSTOM="${ZSH_CUSTOM:-$USER_HOME/.oh-my-zsh/custom}"
+
+{{ if eq .os_family "arch" -}}
+# ----------------------------- ARCH ---------------------------------------
+log "pacman -Syu"
+sudo pacman -Syu --noconfirm
+
+PACMAN_PKGS=(
+    zsh tmux neovim git base-devel
+    bat btop htop fastfetch
+    eza fzf fd ripgrep zoxide starship
+    lazygit yt-dlp jq
+    unzip p7zip
+    openssh
+)
+
+log "installing pacman packages"
+sudo pacman -S --needed --noconfirm "${PACMAN_PKGS[@]}"
+
+{{ else if eq .os_family "debian" -}}
+# ----------------------------- DEBIAN --------------------------------------
+export DEBIAN_FRONTEND=noninteractive
+sudo apt-get update -y
+sudo apt-get upgrade -y
+
+APT_PKGS=(
+    zsh tmux git build-essential
+    bat btop htop fastfetch
+    eza fzf fd-find ripgrep zoxide starship
+    lazygit yt-dlp jq
+    unzip p7zip
+    openssh-client
+    ca-certificates curl wget
+)
+
+log "installing apt packages"
+sudo apt-get install -y --no-install-recommends "${APT_PKGS[@]}"
+
+# fd on Debian ships as 'fdfind' to avoid clashing with fd (the dedupe tool).
+# Symlink so .zshrc can find 'fd' on PATH.
+if command -v fdfind >/dev/null 2>&1 && ! command -v fd >/dev/null 2>&1; then
+    log "symlinking fdfind -> fd in ~/.local/bin"
+    mkdir -p "$USER_HOME/.local/bin"
+    ln -sf "$(command -v fdfind)" "$USER_HOME/.local/bin/fd"
+fi
+
+# Debian's neovim in stable is too old for LazyVim (needs >=0.9).
+# If installed neovim is <0.9, fetch the official binary tarball.
+if command -v nvim >/dev/null 2>&1; then
+    NVIM_VER="$(nvim --version | head -1 | awk '{print $2}' | tr -d 'v')"
+    NVIM_MAJOR="$(echo "$NVIM_VER" | cut -d. -f1)"
+    NVIM_MINOR="$(echo "$NVIM_VER" | cut -d. -f2)"
+    if [[ "${NVIM_MAJOR:-0}" -lt 1 || ("$NVIM_MAJOR" -eq 0 && "${NVIM_MINOR:-0}" -lt 9) ]]; then
+        log "installed neovim $NVIM_VER is too old, installing official binary"
+        sudo apt-get remove -y neovim || true
+        cd /tmp
+        NVIM_LATEST="$(curl -fsSL https://api.github.com/repos/neovim/neovim/releases/latest | grep tag_name | cut -d'"' -f4)"
+        curl -fL "https://github.com/neovim/neovim/releases/download/${NVIM_LATEST}/nvim-linux64.tar.gz" -o nvim.tar.gz
+        sudo tar -xzf nvim.tar.gz -C /opt/
+        sudo ln -sf /opt/nvim-linux64/bin/nvim /usr/local/bin/nvim
+        rm -f nvim.tar.gz
+    fi
+fi
+
+{{ else -}}
+die "unsupported os_family: {{ .os_family }}"
+{{ end -}}
+
+# --------------------------- OH-MY-ZSH -------------------------------------
+if [[ ! -d "$USER_HOME/.oh-my-zsh" ]]; then
+    log "installing oh-my-zsh (unattended)"
+    RUNZSH=no CHSH=no sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"
+else
+    log "oh-my-zsh already installed"
+fi
+
+# zsh plugins (loaded by .zshrc)
+install_zsh_plugin() {
+    local repo="$1" target="$2"
+    if [[ -d "$target" ]]; then
+        log "plugin already present: $target"
+    else
+        log "cloning plugin: $repo"
+        git clone --depth 1 "https://github.com/$repo.git" "$target"
+    fi
+}
+
+install_zsh_plugin zsh-users/zsh-autosuggestions        "$ZSH_CUSTOM/plugins/zsh-autosuggestions"
+install_zsh_plugin zsh-users/zsh-syntax-highlighting    "$ZSH_CUSTOM/plugins/zsh-syntax-highlighting"
+install_zsh_plugin zsh-users/zsh-history-substring-search "$ZSH_CUSTOM/plugins/zsh-history-substring-search"
+
+# --------------------------- TPM (tmux plugin manager) ---------------------
+if [[ ! -d "$USER_HOME/.tmux/plugins/tpm" ]]; then
+    log "cloning tmux plugin manager"
+    mkdir -p "$USER_HOME/.tmux/plugins"
+    git clone --depth 1 https://github.com/tmux-plugins/tpm "$USER_HOME/.tmux/plugins/tpm"
+else
+    log "tpm already installed"
+fi
+
+# --------------------------- set zsh as default shell ---------------------
+USER_SHELL="$(getent passwd "$(whoami)" | cut -d: -f7)"
+if [[ "$USER_SHELL" != "$(command -v zsh)" ]]; then
+    log "changing login shell to zsh"
+    chsh -s "$(command -v zsh)"
+else
+    log "zsh already the login shell"
+fi
+
+log "all user packages installed"
+zsh --version
+nvim --version | head -1
+tmux -V