Add Gentoo support with GURU overlay requirement

Tadbit (tadbit-gentoo, x86_64, gcc 15.2.1, TKG kernel) joins the
homelab as the 7th machine — the first gentoo box. Adds Gentoo
support to the bootstrap alongside arch and debian.

New scripts:
- run_once_10-add-gentoo-overlays.sh.tmpl: enables GURU overlay
  via 'eselect repository enable guru' + 'emaint sync -r guru'.
  Idempotent — skips if GURU is already at /var/db/repos/guru.
  GURU is required because eza, lazygit, topgrade, and most modern
  CLI tools only live in GURU (not main).
- run_once_20-install-user-packages-gentoo.sh.tmpl: emerge-based
  user package set. Writes USE flags to package.use/ BEFORE
  emerging so foot/wofi/waybar get the right features. Detects
  missing packages via 'command -v <basename>'. Falls back to
  the official curl installer for bun (no gentoo package).
- run_once_40-install-sway-gentoo.sh.tmpl: sway stack via emerge
  with USE flags for X+wayland+tray+upower+wireplumber.

Updated scripts:
- .chezmoi.yaml.tmpl: os_family detection now also matches 'gentoo'.
  Critical fix: Gentoo's /etc/os-release uses single-quoted values
  ('gentoo' not 'gentoo' or "gentoo"), and chezmoi's parser doesn't
  strip them. Without trimAll "'", .chezmoi.osRelease.id returns
  the literal string 'gentoo' with quotes, and the eq test fails.
  Symptom: os_family silently becomes 'unknown'.
- run_once_00-install-bootstrap-tools.sh.tmpl: added gentoo branch
  that uses emerge --sync + emerge (skipping if tree is < 1 day old).
- run_onchange_30-ensure-cargo.sh.tmpl: added gentoo branch for
  bat (already installed by emerge, just verify), topgrade (GURU),
  cargo-update (dev-util/cargo-update in main).

README: documented Gentoo-specific quirks (USE flags, GURU,
single-quote parsing, no binary packages).

run_once_00-install-bootstrap-tools.sh.tmpl

@@ -54,8 +54,42 @@ else
     log "all base tools already installed; skipping apt"
 fi
 
+{{ else if eq .os_family "gentoo" -}}
+# Gentoo: bootstrap tools come from the main tree. `age` is in the
+# main tree (app-crypt/age), curl/ca-certificates/git are @system.
+# Skip the install only if everything is already present (no
+# `emerge` no-op — emerge is slow and a fresh sync can take minutes).
+MISSING_PKGS=()
+for p in age curl ca-certificates git wget gnupg; do
+    if ! command -v "$p" >/dev/null 2>&1; then
+        MISSING_PKGS+=("$p")
+    fi
+done
+
+if (( ${#MISSING_PKGS[@]} > 0 )); then
+    log "emerge bootstrap tools (missing: ${MISSING_PKGS[*]})"
+    # On Gentoo, `emerge --sync` is required first to populate the
+    # portage tree. If the box hasn't synced in a while, do it now.
+    # Skip the sync if /var/db/repos/gentoo is recent (< 1 day).
+    sync_needed=1
+    if [[ -d /var/db/repos/gentoo ]]; then
+        # Check age of the metadata timestamp
+        sync_needed=$(find /var/db/repos/gentoo -name 'metadata.timestamp' -mtime -1 2>/dev/null | head -1 | wc -l)
+    fi
+    if (( sync_needed == 0 )); then
+        log "portage tree is fresh (< 1 day old); skipping emerge --sync"
+    else
+        log "emerge --sync (portage tree is stale or missing)"
+        sudo emerge --sync
+    fi
+    log "emerge bootstrap tools"
+    sudo emerge --ask=n --nospinner --quiet-build "${MISSING_PKGS[@]}"
+else
+    log "all base tools already installed; skipping emerge"
+fi
+
 {{ else -}}
-die "unsupported os_family: {{ .os_family }} (this script supports arch or debian)"
+die "unsupported os_family: {{ .os_family }} (this script supports arch, debian, or gentoo)"
 {{ end -}}
 
 log "bootstrap tools installed"