Add Gentoo support with GURU overlay requirement

Tadbit (tadbit-gentoo, x86_64, gcc 15.2.1, TKG kernel) joins the
homelab as the 7th machine — the first gentoo box. Adds Gentoo
support to the bootstrap alongside arch and debian.

New scripts:
- run_once_10-add-gentoo-overlays.sh.tmpl: enables GURU overlay
  via 'eselect repository enable guru' + 'emaint sync -r guru'.
  Idempotent — skips if GURU is already at /var/db/repos/guru.
  GURU is required because eza, lazygit, topgrade, and most modern
  CLI tools only live in GURU (not main).
- run_once_20-install-user-packages-gentoo.sh.tmpl: emerge-based
  user package set. Writes USE flags to package.use/ BEFORE
  emerging so foot/wofi/waybar get the right features. Detects
  missing packages via 'command -v <basename>'. Falls back to
  the official curl installer for bun (no gentoo package).
- run_once_40-install-sway-gentoo.sh.tmpl: sway stack via emerge
  with USE flags for X+wayland+tray+upower+wireplumber.

Updated scripts:
- .chezmoi.yaml.tmpl: os_family detection now also matches 'gentoo'.
  Critical fix: Gentoo's /etc/os-release uses single-quoted values
  ('gentoo' not 'gentoo' or "gentoo"), and chezmoi's parser doesn't
  strip them. Without trimAll "'", .chezmoi.osRelease.id returns
  the literal string 'gentoo' with quotes, and the eq test fails.
  Symptom: os_family silently becomes 'unknown'.
- run_once_00-install-bootstrap-tools.sh.tmpl: added gentoo branch
  that uses emerge --sync + emerge (skipping if tree is < 1 day old).
- run_onchange_30-ensure-cargo.sh.tmpl: added gentoo branch for
  bat (already installed by emerge, just verify), topgrade (GURU),
  cargo-update (dev-util/cargo-update in main).

README: documented Gentoo-specific quirks (USE flags, GURU,
single-quote parsing, no binary packages).

run_onchange_30-ensure-cargo.sh.tmpl

@@ -37,7 +37,7 @@ log "cargo installed: $(cargo --version)"
 
 # --- 2. Install bat (upstream binary, not renamed batcat) ---
 # On debian, apt installs bat as "batcat" (Debian has its own unrelated bat).
-# The clean fix is cargo install on debian, pacman on arch.
+# The clean fix is cargo install on debian, pacman on arch, portage on gentoo.
 {{ if eq .os_family "debian" -}}
 if ! command -v bat >/dev/null 2>&1; then
     log "installing bat via cargo (debian renames upstream bat to batcat)"
@@ -46,6 +46,13 @@ if ! command -v bat >/dev/null 2>&1; then
 else
     log "bat already installed: $(bat --version)"
 fi
+{{ else if eq .os_family "gentoo" -}}
+# Gentoo: app-text/bat is in main, ships upstream binary
+if ! command -v bat >/dev/null 2>&1; then
+    log "WARNING: bat not installed — should have been installed by run_once_20"
+else
+    log "bat already installed (gentoo: app-text/bat): $(bat --version)"
+fi
 {{ else -}}
 # Arch already installs upstream bat via pacman [extra].
 log "skipping cargo bat install (os_family={{ .os_family }}, pacman handles it)"
@@ -58,6 +65,7 @@ log "skipping cargo bat install (os_family={{ .os_family }}, pacman handles it)"
 #   - arch: topgrade is in [chaotic-aur] (we have chaotic-aur configured).
 #           Use pacman to get system-tracked installs.
 #   - debian: topgrade isn't in apt. Install via cargo (no PM alternative).
+#   - gentoo: topgrade is in GURU overlay. Use emerge.
 if ! command -v topgrade >/dev/null 2>&1; then
 {{ if eq .os_family "arch" -}}
     log "installing topgrade via pacman (chaotic-aur)"
@@ -65,6 +73,9 @@ if ! command -v topgrade >/dev/null 2>&1; then
 {{ else if eq .os_family "debian" -}}
     log "installing topgrade via cargo (debian has no topgrade package)"
     cargo install topgrade --locked
+{{ else if eq .os_family "gentoo" -}}
+    log "installing topgrade via emerge (gentoo: app-misc/topgrade in GURU)"
+    sudo emerge --ask=n --nospinner --quiet-build app-misc/topgrade
 {{ else -}}
     log "WARNING: topgrade install not configured for os_family={{ .os_family }}"
 {{ end -}}
@@ -75,7 +86,7 @@ fi
 
 # --- 4. Install cargo-update (so we can `cargo install-update -a`) ---
 # Used to bump cargo-installed packages. Arch has it in [extra]; debian
-# doesn't ship it.
+# doesn't ship it; gentoo has it in main (dev-util/cargo-update).
 if ! command -v cargo-install-update >/dev/null 2>&1; then
 {{ if eq .os_family "arch" -}}
     log "installing cargo-update via pacman"
@@ -83,6 +94,9 @@ if ! command -v cargo-install-update >/dev/null 2>&1; then
 {{ else if eq .os_family "debian" -}}
     log "installing cargo-update via cargo (debian has no cargo-update package)"
     cargo install cargo-update --locked
+{{ else if eq .os_family "gentoo" -}}
+    log "installing cargo-update via emerge (gentoo: dev-util/cargo-update)"
+    sudo emerge --ask=n --nospinner --quiet-build dev-util/cargo-update
 {{ else -}}
     log "WARNING: cargo-update install not configured for os_family={{ .os_family }}"
 {{ end -}}