Rebuild dotfiles as one branch with per-host layers

Replaces the previous repo, which had split into two histories that never
met (mainframe on a dead GitLab remote, the laptops on Gitea) with 146
dirty files across three machines and the NAS never enrolled at all.

Branch-per-machine is gone. One main, with host differences expressed as
small files under hosts/<hostname>/ rather than as branches, so there is
nothing to merge. The reconciled zsh layer reduces 15-33 line forks to
1-7 effective lines per host; distro differences (oh-my-zsh prefix,
syntax-highlighting path, fd vs fdfind) are probed in common/ instead.

Fresh history: the old one carried six plaintext credentials, 45 MB of
mail caches, browser caches and vendored binaries. 5,096 tracked files
and 144 MB become 462 files and 2.6 MB. The .gitignore is now an
allowlist, which is what keeps that true.

Root cause of the rot: ~/.local/bin was a symlink to scripts/ with GOPATH
inside it, so every go install wrote into version control (2.2 GB on the
work laptop). PATH now points at the repo instead of the reverse.

Also: Hyprland replaces sway and is sourced in two halves so $browser is
defined before use; singleton automations carry ConditionHost= alongside
host-layer-only placement; ddns moves from cron to a guarded timer;
package manifests and pkg-snapshot/pkg-restore replace the X11-era
install_scripts/; networkmanager-dmenu added to system76 (the binding
always existed, the package never did).

hosts/mainframe/systemd/ddns.service

@@ -0,0 +1,9 @@
+[Unit]
+Description=Dynamic DNS record update
+# Singleton: updates live DNS records. Was a user crontab entry
+# (0 2 */2 * * ~/.local/bin/ddns_update) until the 2026-09 refit.
+ConditionHost=mainframe
+
+[Service]
+Type=oneshot
+ExecStart=%h/.dotfiles/hosts/mainframe/bin/ddns_update

hosts/mainframe/systemd/ddns.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=Dynamic DNS record update, every other day
+ConditionHost=mainframe
+
+[Timer]
+OnCalendar=*-*-*/2 02:00:00
+Persistent=true
+
+[Install]
+WantedBy=timers.target

hosts/mainframe/systemd/inbox-tidy.service

@@ -0,0 +1,19 @@
+[Unit]
+# Singleton: this automation must run on mainframe and nowhere else.
+# Structural guard is hosts/mainframe/ placement; this is the backstop.
+ConditionHost=mainframe
+Description=Archive stale unread mail out of the Proton inbox
+Documentation=file:///home/connor/docs/mail/deploy/README.md
+# Proton Bridge is a container, not a user unit, so this cannot Requires= it.
+# The script pushes a failure notification if Bridge is down or unauthenticated.
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+EnvironmentFile=-%h/.config/proton/bridge.env
+ExecStart=%h/.dotfiles/hosts/mainframe/bin/inbox_tidy
+# Classifying ~1200 messages means fetching that many header sets over
+# loopback IMAP. Slow, but nowhere near this ceiling.
+TimeoutStartSec=30min
+Nice=10

hosts/mainframe/systemd/inbox-tidy.timer

@@ -0,0 +1,15 @@
+[Unit]
+Description=Daily inbox tidy
+
+[Timer]
+# Early, so the inbox is already tidy by the time it is first looked at, and
+# well clear of rent-utilities at 09:00 on the 5th.
+OnCalendar=*-*-* 07:30:00
+# If the machine was off, still run on the next boot rather than skipping a day
+# and letting two days of mail pile up.
+Persistent=true
+RandomizedDelaySec=10m
+AccuracySec=1min
+
+[Install]
+WantedBy=timers.target

hosts/mainframe/systemd/movie-recs.service

@@ -0,0 +1,23 @@
+[Unit]
+# Singleton: this automation must run on mainframe and nowhere else.
+# Structural guard is hosts/mainframe/ placement; this is the backstop.
+ConditionHost=mainframe
+Description=Generate movie recommendations from the Radarr library and push to ntfy
+# LiteLLM is a container, not a user unit, so this cannot Requires= it.
+# The script pushes a failure notification if it is unreachable.
+#
+# Timing note: this asks for gemma3-12b, which llama-swap loads on demand and
+# which EVICTS the resident gpt-oss-20b for the duration (one llama-server at
+# a time, one GPU). gemma3-12b then unloads on its own after 900 s idle. So an
+# 08:00 run costs the next OpenCode request a cold gpt-oss-20b reload. That is
+# the intended trade -- a once-daily swap is exactly the "keep swaps rare"
+# budget the llama-swap config is written around.
+After=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=%h/.dotfiles/hosts/mainframe/bin/movie_recs_notify
+# Generation on a partially-offloaded model is slow; do not let systemd
+# kill a run that is still making progress.
+TimeoutStartSec=2700
+Nice=10

hosts/mainframe/systemd/movie-recs.timer

@@ -0,0 +1,12 @@
+[Unit]
+Description=Daily movie recommendations
+
+[Timer]
+OnCalendar=*-*-* 08:00:00
+# Fire on next boot if the machine was off at 08:00.
+Persistent=true
+# Avoid colliding with anything else that starts on the hour.
+RandomizedDelaySec=10m
+
+[Install]
+WantedBy=timers.target

hosts/mainframe/systemd/rent-utilities.service

@@ -0,0 +1,22 @@
+[Unit]
+# Singleton: this automation must run on mainframe and nowhere else.
+# Structural guard is hosts/mainframe/ placement; this is the backstop.
+ConditionHost=mainframe
+Description=Assemble the rental utilities message and push it to ntfy
+Documentation=file:///home/connor/docs/leases/deploy/README.md
+# Proton Bridge is a container, not a user unit, so this cannot Requires= it.
+# The script pushes a failure notification if Bridge is down or unauthenticated,
+# which is the point -- a monthly job that fails silently is invisible until the
+# next run, by which time you have stopped expecting it.
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+# Holds PROTON_BRIDGE_PASSWORD. `-` so the unit still runs (and still pushes a
+# useful error) before Bridge has ever been set up.
+EnvironmentFile=-%h/.config/proton/bridge.env
+ExecStart=%h/.dotfiles/hosts/mainframe/bin/rent_utilities
+# Fetching two statements over loopback IMAP; a minute is already generous.
+TimeoutStartSec=300
+Nice=10

hosts/mainframe/systemd/rent-utilities.timer

@@ -0,0 +1,15 @@
+[Unit]
+Description=Monthly rental utilities message
+
+[Timer]
+# The 5th: late enough that both statements for the previous month have
+# normally landed, early enough to leave room to chase one that has not.
+OnCalendar=*-*-05 09:00:00
+# If the machine was down on the 5th, still run on the next boot rather than
+# skipping the month entirely.
+Persistent=true
+RandomizedDelaySec=5m
+AccuracySec=1min
+
+[Install]
+WantedBy=timers.target