topgrade: gate neovim tarball updater to debian family only

update-neovim.sh and the topgrade [commands] entry that calls it are
only meaningful where neovim is not a distro package. On arch-family
boxes the template renders empty, so chezmoi removes the script
instead of deploying a no-op, and topgrade no longer runs a step that
could fail on unmanaged paths.

dot_config/topgrade/topgrade.toml.tmpl

@@ -0,0 +1,41 @@
+# =============================================================================
+#  topgrade.toml — chezmoi-managed
+#  Most steps (system, flatpak, snap, cargo, npm, pyenv, rustup, etc.)
+#  are auto-detected by topgrade when their binaries are on $PATH. Only set
+#  custom config here.
+# =============================================================================
+
+[misc]
+# Run `sudo -v` at the start so cached credentials cover the whole run.
+# Without this, topgrade will pause for password mid-run on each sudo invocation.
+pre_sudo = true
+
+# Do not set the terminal title.
+set_title = false
+
+# Don't ask for confirmations.
+assume_yes = true
+
+# Disable specific steps — same option names as the CLI flag.
+# `shell` covers the oh-my-zsh step (topgrade has no per-framework variant).
+disable = ["chezmoi", "emacs", "uv", "distrobox", "shell"]
+
+# No ignore_failures — any step failure halts the run; nothing is skipped.
+
+# Print the time in step titles for verbose output.
+display_time = true
+
+[git]
+# Additional git repositories to pull (besides the predefined ones).
+repos = [
+    "~/Documents/Git/*"
+]
+
+{{- if eq .os_family "debian" }}
+[commands]
+# Debian-family-only: apt neovim is stale, so debian machines install from
+# the pinned binary tarball. Arch-family boxes get neovim from pacman/aur,
+# so neither the script nor this entry is deployed there.
+"~/.local/bin/update-neovim.sh" = "neovim"
+{{- end }}
+