Rebuild dotfiles as one branch with per-host layers

Replaces the previous repo, which had split into two histories that never
met (mainframe on a dead GitLab remote, the laptops on Gitea) with 146
dirty files across three machines and the NAS never enrolled at all.

Branch-per-machine is gone. One main, with host differences expressed as
small files under hosts/<hostname>/ rather than as branches, so there is
nothing to merge. The reconciled zsh layer reduces 15-33 line forks to
1-7 effective lines per host; distro differences (oh-my-zsh prefix,
syntax-highlighting path, fd vs fdfind) are probed in common/ instead.

Fresh history: the old one carried six plaintext credentials, 45 MB of
mail caches, browser caches and vendored binaries. 5,096 tracked files
and 144 MB become 462 files and 2.6 MB. The .gitignore is now an
allowlist, which is what keeps that true.

Root cause of the rot: ~/.local/bin was a symlink to scripts/ with GOPATH
inside it, so every go install wrote into version control (2.2 GB on the
work laptop). PATH now points at the repo instead of the reverse.

Also: Hyprland replaces sway and is sourced in two halves so $browser is
defined before use; singleton automations carry ConditionHost= alongside
host-layer-only placement; ddns moves from cron to a guarded timer;
package manifests and pkg-snapshot/pkg-restore replace the X11-era
install_scripts/; networkmanager-dmenu added to system76 (the binding
always existed, the package never did).

hosts/sctfw004/sbin/backlight-idle

@@ -0,0 +1,76 @@
+#!/bin/sh
+# Dim or restore every backlight device present, including any external monitor
+# that ddcci has registered. DDC/CI writes take about a second each, so the
+# monitors are driven concurrently rather than in sequence.
+
+DIM_LEVEL=5
+RESTORE_TIMEOUT=60
+STATE="${XDG_STATE_HOME:-$HOME/.local/state}/backlight-idle"
+LOG="$STATE/log"
+
+mkdir -p "$STATE" 2>/dev/null
+
+log() { printf '%s %s\n' "$(date '+%F %T.%3N')" "$*" >>"$LOG" 2>/dev/null; }
+
+is_num() { case "$1" in ''|*[!0-9]*) return 1 ;; *) return 0 ;; esac; }
+
+# actual_brightness is a live DDC read, so it reports what the panel really has.
+# brightness is only the driver's cache, which accepts a write even when the bus
+# is down and then reverts to the panel's value seconds later.
+panel_level() { cat "/sys/class/backlight/$1/actual_brightness" 2>/dev/null; }
+
+dim_dev() {
+    dev=$1
+    cur=$(cat "/sys/class/backlight/$dev/brightness" 2>/dev/null)
+    is_num "$cur" || { log "  dim $dev skipped, unreadable"; return; }
+
+    # Re-dimming would overwrite the saved level with the dimmed one.
+    [ "$cur" -le "$DIM_LEVEL" ] && { log "  dim $dev skipped, already dim"; return; }
+
+    level=$(panel_level "$dev")
+    is_num "$level" || level=$cur
+    printf '%s\n' "$level" >"$STATE/$dev" || { log "  dim $dev skipped, cannot save"; return; }
+
+    brightnessctl -d "$dev" set "$DIM_LEVEL" >/dev/null 2>&1
+    log "  dim $dev rc=$? saved=$level"
+}
+
+# The panel is read back after every write because a write issued while DDC is
+# down is silently kept in the driver cache and never reaches the monitor.
+restore_dev() {
+    dev=$1
+    target=$(cat "$STATE/$dev" 2>/dev/null)
+    is_num "$target" || { log "  restore $dev skipped, no saved level"; return; }
+
+    deadline=$(($(date +%s) + RESTORE_TIMEOUT))
+    tries=0
+    while :; do
+        brightnessctl -d "$dev" set "$target" >/dev/null 2>&1
+        tries=$((tries + 1))
+        actual=$(panel_level "$dev")
+
+        [ "$actual" = "$target" ] && { log "  restore $dev ok target=$target tries=$tries"; return; }
+        [ "$(date +%s)" -ge "$deadline" ] && {
+            log "  restore $dev FAILED target=$target actual=${actual:-unreadable} tries=$tries"; return; }
+        sleep 2
+    done
+}
+
+case "$1" in
+    dim|restore) ;;
+    *) echo "usage: ${0##*/} {dim|restore}" >&2; exit 1 ;;
+esac
+
+log "$1 begin"
+
+for path in /sys/class/backlight/*; do
+    [ -e "$path" ] || continue
+    dev=${path##*/}
+    case "$1" in
+        dim)     dim_dev "$dev" & ;;
+        restore) restore_dev "$dev" & ;;
+    esac
+done
+
+wait
+log "$1 end"

hosts/sctfw004/sbin/ddcci-bind

@@ -0,0 +1,63 @@
+#!/bin/sh
+# Attach the ddcci driver to external monitors on their DP AUX bus.
+# The connector's `ddc` symlink points at the native I2C bus, which is dead on
+# DisplayPort, so the aux adapter is selected by name instead.
+#
+# Monitors often do not answer DDC/CI for the first several seconds after boot
+# or a hotplug, and that probe failure leaves a live i2c client with no backlight
+# behind, so binding is retried rather than attempted once.
+#
+# Retries only ever discard a client whose probe failed. ddcci-dkms 0.4.4 leaks a
+# chardev minor whenever a real ddcci device is destroyed, and the orphan blocks
+# the next monitor with -EEXIST until a reboot, but a failed probe never created
+# one. A client that did produce a ddcci device is left strictly alone.
+
+RETRIES=5
+SETTLE=3
+
+exec 9>/run/ddcci-bind.lock
+flock -w 120 9 || exit 0
+
+[ -n "$DDCCI_BIND_DELAY" ] && sleep "$DDCCI_BIND_DELAY"
+
+has_backlight() {
+    ls "/sys/bus/i2c/devices/$1-0037"/ddcci*/backlight/* >/dev/null 2>&1
+}
+
+has_ddcci_device() {
+    ls -d "/sys/bus/i2c/devices/$1-0037"/ddcci* >/dev/null 2>&1
+}
+
+bind_bus() {
+    n=$1
+    i=0
+    while [ "$i" -lt "$RETRIES" ]; do
+        has_backlight "$n" && return 0
+
+        if [ -e "/sys/bus/i2c/devices/$n-0037" ]; then
+            has_ddcci_device "$n" && return 1
+            echo 0x37 > "/sys/bus/i2c/devices/i2c-$n/delete_device" 2>/dev/null
+            sleep 1
+        fi
+
+        echo ddcci 0x37 > "/sys/bus/i2c/devices/i2c-$n/new_device" 2>/dev/null
+        sleep "$SETTLE"
+        i=$((i + 1))
+    done
+
+    has_backlight "$n"
+}
+
+for conn in /sys/class/drm/card*-DP-* /sys/class/drm/card*-HDMI-*; do
+    [ -r "$conn/status" ] || continue
+    [ "$(cat "$conn/status")" = connected ] || continue
+
+    for bus in "$conn"/i2c-*; do
+        [ -d "$bus" ] || continue
+        n=${bus##*/i2c-}
+
+        case "$(cat "/sys/bus/i2c/devices/i2c-$n/name" 2>/dev/null)" in
+            *aux*) bind_bus "$n" ;;
+        esac
+    done
+done

hosts/sctfw004/sbin/monitor-layout

@@ -0,0 +1,65 @@
+#!/bin/sh
+# Generate kanshi's dock profile from kernel EDID.
+#
+# Neither identity kanshi can see is trustworthy here: Hyprland reports each
+# monitor's serial on the other monitor's output, and connector names get
+# renumbered when the dock brings displays back in a different order. The
+# kernel reads EDID over each connector's own DDC channel and is correct, so
+# connector names are resolved from serials fresh on every display change.
+
+USER_NAME=connorjohnstone
+CONF=/home/$USER_NAME/.config/kanshi/generated
+SCALE=1.5
+
+# Serials in the physical left-to-right order they sit on the desk.
+ORDER="PB4HB16301805 PB4HB16301801"
+
+exec 9>/run/monitor-layout.lock
+flock -w 60 9 || exit 0
+
+[ -n "$LAYOUT_DELAY" ] && sleep "$LAYOUT_DELAY"
+
+connector_for_serial() {
+	for c in /sys/class/drm/card*-*; do
+		[ -r "$c/status" ] || continue
+		[ "$(cat "$c/status")" = connected ] || continue
+		if edid-decode <"$c/edid" 2>/dev/null | grep -qF "'$1'"; then
+			echo "$c"
+			return 0
+		fi
+	done
+	return 1
+}
+
+# Same directory as $CONF so the final rename is atomic: kanshi reloads on
+# SIGHUP and must never observe a half-written config.
+tmp=$(mktemp "$CONF.XXXXXX") || exit 1
+trap 'rm -f "$tmp"' EXIT INT TERM
+
+body=""
+x=0
+
+for serial in $ORDER; do
+	path=$(connector_for_serial "$serial") || continue
+	name=$(basename "$path" | sed 's/^card[0-9]*-//')
+
+	mode=$(head -1 "$path/modes" 2>/dev/null)
+	[ -n "$mode" ] || continue
+	width=$(awk -v m="${mode%%x*}" -v s="$SCALE" 'BEGIN{printf "%d", m / s}')
+
+	body="$body	output $name enable position $x,0 scale $SCALE
+"
+	x=$((x + width))
+done
+
+if [ -n "$body" ]; then
+	printf 'profile generated_dock {\n%s	output eDP-1 disable\n}\n' "$body" >"$tmp"
+else
+	: >"$tmp"
+fi
+
+chown "$USER_NAME:$USER_NAME" "$tmp"
+chmod 0644 "$tmp"
+mv -f "$tmp" "$CONF"
+
+pkill -HUP -u "$USER_NAME" kanshi