Rebuild dotfiles as one branch with per-host layers

Replaces the previous repo, which had split into two histories that never
met (mainframe on a dead GitLab remote, the laptops on Gitea) with 146
dirty files across three machines and the NAS never enrolled at all.

Branch-per-machine is gone. One main, with host differences expressed as
small files under hosts/<hostname>/ rather than as branches, so there is
nothing to merge. The reconciled zsh layer reduces 15-33 line forks to
1-7 effective lines per host; distro differences (oh-my-zsh prefix,
syntax-highlighting path, fd vs fdfind) are probed in common/ instead.

Fresh history: the old one carried six plaintext credentials, 45 MB of
mail caches, browser caches and vendored binaries. 5,096 tracked files
and 144 MB become 462 files and 2.6 MB. The .gitignore is now an
allowlist, which is what keeps that true.

Root cause of the rot: ~/.local/bin was a symlink to scripts/ with GOPATH
inside it, so every go install wrote into version control (2.2 GB on the
work laptop). PATH now points at the repo instead of the reverse.

Also: Hyprland replaces sway and is sourced in two halves so $browser is
defined before use; singleton automations carry ConditionHost= alongside
host-layer-only placement; ddns moves from cron to a guarded timer;
package manifests and pkg-snapshot/pkg-restore replace the X11-era
install_scripts/; networkmanager-dmenu added to system76 (the binding
always existed, the package never did).

common/zsh/zshenv

@@ -0,0 +1,51 @@
+# Read by EVERY zsh, including non-interactive ones (scripts, `ssh host cmd`).
+# Keep it cheap: no subshells in the hot path, no vault lookups, no network.
+
+export DOTFILES="${DOTFILES:-$HOME/.dotfiles}"
+: ${DOTFILES_HOST:=${(L)${HOST:-$(hostname)}}}   # lowercased; SCTFW004 -> sctfw004
+export DOTFILES_HOST
+
+export EDITOR="nvim"
+export BROWSER="qutebrowser"
+export GTK_THEME="Arc:dark"
+export XDG_DOWNLOAD_DIR="$HOME/downloads"
+export QUTEWAL_DYNAMIC_LOADING=True
+export NEOVIDE_FORK=1
+export RUSTFLAGS="-L/usr/local/lib"
+
+# `col -bx` strips the backspace-overstrike bold that otherwise reaches bat as
+# literal ^H sequences. MANROFFOPT=-c is required alongside it.
+export MANPAGER="sh -c 'col -bx | bat -l man -p'"
+export MANROFFOPT="-c"
+
+# NOT $HOME/.local/bin. That used to be a symlink to this repo's scripts/, so
+# `go install` wrote 1.6 GB into version control. See README.
+export GOPATH="$HOME/.local/share/go"
+export ANDROID_HOME="$HOME/Android/Sdk"
+
+# opencode's {env:} interpolation has no fallback syntax: an unset value becomes
+# an empty string and every request fails with an opaque URL parse error. Set
+# here rather than in .zshrc so non-interactive shells resolve it too.
+export LITELLM_BASE="${LITELLM_BASE:-http://127.0.0.1:4000}"
+
+# Repo scripts come first; host-specific ones shadow the shared ones.
+path=(
+  "$DOTFILES/hosts/$DOTFILES_HOST/bin"
+  "$DOTFILES/common/bin"
+  "$HOME/.local/bin"
+  "$GOPATH/bin"
+  "$HOME/.cargo/bin"
+  /usr/lib/jvm/default/bin
+  $path
+)
+export PATH
+
+[[ -r "$HOME/.local/share/bob/env/env.sh" ]] && . "$HOME/.local/share/bob/env/env.sh"
+
+for _f in "$DOTFILES/hosts/$DOTFILES_HOST"/zsh/*.zshenv(N); do source "$_f"; done
+unset _f
+
+# Untracked, mode 600. See common/zsh/secrets.zsh.example.
+[[ -r "$HOME/.secrets.zsh" ]] && source "$HOME/.secrets.zsh"
+
+true