Gentoo bootstrap: fix ambiguous package names + early-return on os_family mismatch

Three issues caught during tadbit onboarding:

1. run_once_00-install-bootstrap-tools.sh.tmpl (gentoo branch):
   'gnupg' is ambiguous (app-crypt/gnupg vs app-vim/gnupg). Use full
   category/package names: app-crypt/gnupg, app-crypt/age, etc.
   The previous 'for p in age curl ...' loop fed short names to
   emerge which printed '!!! The short ebuild name gnupg is
   ambiguous' and exited 1.

2. run_once_20-install-user-packages-gentoo.sh.tmpl:
   sys-devel/base-devel doesn't exist on Gentoo (it's an Arch/Fedora
   concept; Gentoo's toolchain is the @system set which is always
   installed). Removed base-devel from the package list.

3. Universal scripts (run_once_20 + run_once_40) were running on
   gentoo and hitting either 'die unsupported os_family' (universal
   20) or 'WARNING sway packages not configured for gentoo' (universal
   40). Added early-return: 'if os_family == gentoo, exit 0' at the
   top of each universal script so the gentoo-specific scripts
   handle the box. (Same pattern the chaotic-aur script already had.)

4. run_once_10-add-gentoo-overlays.sh.tmpl:
   The cached ~/.cache/eselect-repo/repositories.xml was corrupt on
   tadbit (lxml.etree.XMLSyntaxError on every 'eselect repository
   list' call). Added a sanity check: parse the XML with
   xml.etree.ElementTree, delete if invalid, re-fetch.

After these fixes, the bootstrap on tadbit is expected to run cleanly
with --keep-going (the four failures above all become no-ops).

run_once_00-install-bootstrap-tools.sh.tmpl

@@ -59,9 +59,25 @@ fi
 # main tree (app-crypt/age), curl/ca-certificates/git are @system.
 # Skip the install only if everything is already present (no
 # `emerge` no-op — emerge is slow and a fresh sync can take minutes).
+#
+# Use full category/package names for ambiguous short names:
+# `gnupg` is ambiguous (app-crypt/gnupg vs app-vim/gnupg) and
+# `base-devel` doesn't exist in main (use the @system set instead).
+GENTOO_BOOTSTRAP_PKGS=(
+    app-crypt/age
+    app-crypt/gnupg
+    net-misc/curl
+    app-misc/ca-certificates
+    dev-vcs/git
+    net-misc/wget
+)
 MISSING_PKGS=()
-for p in age curl ca-certificates git wget gnupg; do
-    if ! command -v "$p" >/dev/null 2>&1; then
+for p in "${GENTOO_BOOTSTRAP_PKGS[@]}"; do
+    # bin name is the package basename; for @system packages like
+    # ca-certificates we accept that `command -v ca-certificates`
+    # may not exist (those are pseudo-packages). Use equery as fallback.
+    bin_name=$(basename "$p")
+    if ! command -v "$bin_name" >/dev/null 2>&1; then
         MISSING_PKGS+=("$p")
     fi
 done

run_once_10-add-gentoo-overlays.sh.tmpl

@@ -30,7 +30,16 @@ if [[ -d /var/db/repos/guru ]]; then
     log "GURU overlay already enabled at /var/db/repos/guru — skipping"
 else
     log "enabling GURU overlay via eselect repository"
-    # `eselect repository` needs the overlays.xml index; sync first if missing
+    # `eselect repository` needs the overlays.xml index. If the cached
+    # one is corrupt (lxml.etree.XMLSyntaxError), delete it and re-fetch.
+    ESEL_REPO_CACHE="${HOME}/.cache/eselect-repo/repositories.xml"
+    if [[ -f "$ESEL_REPO_CACHE" ]]; then
+        # Quick sanity check: try to parse the XML. If invalid, delete.
+        if ! python3 -c "import xml.etree.ElementTree as ET; ET.parse('$ESEL_REPO_CACHE')" 2>/dev/null; then
+            log "WARN: $ESEL_REPO_CACHE is corrupt; removing and re-fetching"
+            rm -f "$ESEL_REPO_CACHE"
+        fi
+    fi
     if ! sudo eselect repository list 2>&1 | grep -qi guru; then
         log "fetching overlays.xml index"
         sudo emaint sync --auto

run_once_20-install-user-packages-gentoo.sh.tmpl

@@ -56,6 +56,9 @@ fi
 # we'll install via oh-my-zsh custom plugins (gentoo's ebuilds can lag).
 
 # Step 2: Define the package set
+# Note: on Gentoo there's no `base-devel` meta-package. The toolchain
+# (gcc, binutils, glibc, make, patch, etc.) is part of the @system set
+# which is always installed. We only need to list user-space packages.
 GENTOO_PKGS=(
     app-shells/zsh
     app-shells/zsh-completions
@@ -63,7 +66,6 @@ GENTOO_PKGS=(
     app-admin/tmux
     app-editors/neovim
     dev-vcs/git
-    sys-devel/base-devel
     app-text/bat
     sys-process/btop
     sys-process/htop
@@ -74,8 +76,8 @@ GENTOO_PKGS=(
     sys-apps/ripgrep
     app-shells/zoxide
     app-shells/starship
-    # lazygit is in GURU (app-vim/lazygit? actually app-misc/lazygit in guru)
-    # topgrade is in GURU
+    # lazygit is in GURU (app-misc/lazygit)
+    # topgrade is in GURU (app-misc/topgrade)
     # media-video/yt-dlp is in main
     app-text/jq
     app-arch/unzip

run_once_20-install-user-packages.sh.tmpl

@@ -9,6 +9,11 @@
 #  zsh-history-substring-search, fzf-tab.
 #
 #  Runs as the unprivileged user, but uses sudo for system packages.
+#
+#  Note: this script handles arch and debian. Gentoo uses its own
+#  run_once_20-install-user-packages-gentoo.sh.tmpl. Without the early
+#  return below, this universal script would hit `die "unsupported
+#  os_family"` on gentoo and abort the apply chain.
 # =============================================================================
 set -euo pipefail
 
@@ -27,6 +32,13 @@ export PATH="/usr/bin:/bin:$HOME/.local/bin:$HOME/.bun/bin:$HOME/.cargo/bin:$PAT
 log() { printf '\033[1;34m[packages]\033[0m %s\n' "$*"; }
 die() { printf '\033[1;31m[packages ERROR]\033[0m %s\n' "$*" >&2; exit 1; }
 
+# --- 0. Gentoo uses its own user-packages script ---
+{{ if eq .os_family "gentoo" -}}
+log "user packages install handled by run_once_20-install-user-packages-gentoo.sh.tmpl on gentoo"
+log "exiting to avoid running arch/debian-specific branches"
+exit 0
+{{ end -}}
+
 USER_HOME="${HOME:-$(eval echo "~$(whoami)")}"
 ZSH_CUSTOM="${ZSH_CUSTOM:-$USER_HOME/.oh-my-zsh/custom}"
 

run_once_40-install-sway.sh.tmpl

@@ -10,6 +10,11 @@
 #  `chezmoi apply`. To opt out: `touch ~/.config/chezmoi/features/no-sway`.
 #
 #  Idempotent: skips if sway is already installed.
+#
+#  Note: this script is for arch and debian. Gentoo has its own
+#  run_once_40-install-sway-gentoo.sh.tmpl. Without the early return
+#  below, both scripts would run on gentoo and the universal one
+#  would print "WARNING: sway packages not configured for os_family=gentoo".
 # =============================================================================
 set -euo pipefail
 
@@ -22,6 +27,13 @@ log "To enable: touch ~/.config/chezmoi/features/sway && chezmoi apply"
 exit 0
 {{ end -}}
 
+# --- 0b. Gentoo uses its own sway script (different packages + USE flags) ---
+{{ if eq .os_family "gentoo" -}}
+log "sway stack install handled by run_once_40-install-sway-gentoo.sh.tmpl on gentoo"
+log "to skip this universal script; exiting"
+exit 0
+{{ end -}}
+
 # --- 1. Install packages ---
 SWAY_PKGS=(sway wofi foot swaybg swaylock swayidle grim slurp waybar wl-clipboard)