Initial chezmoi-managed dotfiles with bootstrap scripts

- Rename master to legacy-2025 on remote (frozen pre-chezmoi snapshot)
- New orphan 'main' branch with bootstrap-enabled config
- .chezmoi.yaml.tmpl detects os_family (debian | arch) from /etc/os-release
- dot_zshrc.tmpl refactored from current miche config with os_family
  conditional for pacman vs apt aliases
- dot_config/: bat, btop, ghostty (with gruvbox themes), kitty (with gruvbox
  colors), nvim (LazyVim), paru
- dot_gitconfig.tmpl, dot_tmux.conf (verbatim from current state)
- run_once_00-install-bootstrap-tools.sh.tmpl: age, git, curl, ca-certificates
- run_once_10-add-chaotic-aur.sh.tmpl (arch-only): add Chaotic-AUR + install paru
- run_once_20-install-user-packages.sh.tmpl: zsh, tmux, neovim (with version
  check + binary tarball fallback for debian), oh-my-zsh + plugins, tpm,
  rustup, all CLI tools
- run_onchange_30-ensure-cargo.sh.tmpl: rustup fallback
- README.md with onboarding runbook

run_onchange_30-ensure-cargo.sh.tmpl

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# =============================================================================
+#  run_onchange_30-ensure-cargo.sh.tmpl
+#  Make sure rustup/cargo is available. If not, install rustup.
+#  Runs on every apply because the script body rarely changes but we want a
+#  fresh check after package installs.
+# =============================================================================
+set -euo pipefail
+
+log() { printf '\033[1;34m[cargo]\033[0m %s\n' "$*"; }
+
+if command -v cargo >/dev/null 2>&1; then
+    log "cargo already installed: $(cargo --version)"
+    exit 0
+fi
+
+if command -v rustup >/dev/null 2>&1; then
+    log "rustup present but cargo missing — running rustup default"
+    rustup default stable
+    exit 0
+fi
+
+log "no cargo or rustup — installing rustup"
+sh -c "$(curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs)" -- -y --default-toolchain stable --profile minimal
+# shellcheck disable=SC1091
+source "$HOME/.cargo/env"
+
+log "rustup installed: $(rustup --version)"
+log "cargo installed: $(cargo --version)"