Add omp .env.age for provider API keys; install topgrade+cargo-update via PM

1. dot_omp/agent/encrypted_.env.age (NEW)
   Encrypted shell-sourceable file with all omp provider API keys.
   Decrypts to ~/.omp/agent/.env on apply. omp reads .env on startup
   per docs/environment-variables.md. All 6 recipients (recovery +
   5 boxes) can decrypt. Placeholder values for keys the user hasn't
   added yet — fill in real values per-provider.

2. run_onchange_30-ensure-cargo.sh.tmpl (UPDATED)
   - Add topgrade install: pacman on arch (via chaotic-aur), cargo on
     debian (not in apt)
   - Add cargo-update install: pacman on arch, cargo on debian
   - Prefer OS package managers over cargo install when both are
     available. cargo install only as fallback.

3. dot_omp/agent/config.yml (UNCHANGED)
   Per user request: keep .local host endpoints (llama-swap.miche,
   kaiser.local:8800). If a box can't reach them, it's not on the
   local network and omp will error gracefully at request time.

run_onchange_30-ensure-cargo.sh.tmpl

@@ -4,6 +4,10 @@
 #  Make sure rustup/cargo is available. If not, install rustup.
 #  After cargo is ready, install bat from crates.io on debian (apt renames
 #  upstream bat to batcat, which breaks .zshrc's `alias cat=bat`).
+#  Also install topgrade (universal update tool) and cargo-update (so cargo
+#  packages themselves can be bumped). Prefer OS package managers when
+#  available — only fall back to `cargo install` if the package isn't in
+#  apt/pacman/chaotic-aur.
 #
 #  Runs on every apply because the script body rarely changes but we want a
 #  fresh check after package installs.
@@ -31,16 +35,58 @@ export PATH="$HOME/.cargo/bin:$PATH"
 log "rustup installed: $(rustup --version 2>/dev/null || echo unknown)"
 log "cargo installed: $(cargo --version)"
 
-# --- 2. Install bat from crates.io if missing (debian only) ---
+# --- 2. Install bat (upstream binary, not renamed batcat) ---
+# On debian, apt installs bat as "batcat" (Debian has its own unrelated bat).
+# The clean fix is cargo install on debian, pacman on arch.
 {{ if eq .os_family "debian" -}}
 if ! command -v bat >/dev/null 2>&1; then
-    log "installing bat via cargo (upstream, debian renames it to batcat)"
+    log "installing bat via cargo (debian renames upstream bat to batcat)"
     cargo install bat --locked
     log "bat installed: $(bat --version)"
 else
     log "bat already installed: $(bat --version)"
 fi
 {{ else -}}
-# Arch already installs upstream bat via pacman; nothing extra to do.
+# Arch already installs upstream bat via pacman [extra].
 log "skipping cargo bat install (os_family={{ .os_family }}, pacman handles it)"
-{{ end -}}
+{{ end -}}
+
+# --- 3. Install topgrade (universal update tool) ---
+# topgrade walks through system packages, language toolchains, dev tools,
+# and runs each one's update command. It's a single command for "update
+# everything on this box."
+#   - arch: topgrade is in [chaotic-aur] (we have chaotic-aur configured).
+#           Use pacman to get system-tracked installs.
+#   - debian: topgrade isn't in apt. Install via cargo (no PM alternative).
+if ! command -v topgrade >/dev/null 2>&1; then
+{{ if eq .os_family "arch" -}}
+    log "installing topgrade via pacman (chaotic-aur)"
+    sudo pacman -S --needed --noconfirm topgrade
+{{ else if eq .os_family "debian" -}}
+    log "installing topgrade via cargo (debian has no topgrade package)"
+    cargo install topgrade --locked
+{{ else -}}
+    log "WARNING: topgrade install not configured for os_family={{ .os_family }}"
+{{ end -}}
+    log "topgrade installed: $(topgrade --version | head -1)"
+else
+    log "topgrade already installed: $(topgrade --version | head -1)"
+fi
+
+# --- 4. Install cargo-update (so we can `cargo install-update -a`) ---
+# Used to bump cargo-installed packages. Arch has it in [extra]; debian
+# doesn't ship it.
+if ! command -v cargo-install-update >/dev/null 2>&1; then
+{{ if eq .os_family "arch" -}}
+    log "installing cargo-update via pacman"
+    sudo pacman -S --needed --noconfirm cargo-update
+{{ else if eq .os_family "debian" -}}
+    log "installing cargo-update via cargo (debian has no cargo-update package)"
+    cargo install cargo-update --locked
+{{ else -}}
+    log "WARNING: cargo-update install not configured for os_family={{ .os_family }}"
+{{ end -}}
+    log "cargo-update installed"
+else
+    log "cargo-update already installed"
+fi