feat: shell + dotfiles setup for a fresh box

Two layers with a deliberate privilege split: setup.sh does the root work
(apt, rustup, cargo tools, starship, chsh) and hands off to chezmoi, which
owns everything under $HOME.

Tools are built with `cargo install --locked` to match the versions currently
running rather than whatever apt ships, at the cost of a 10-20 min cold setup.

Excluded on purpose: the atuin sync key and ~/.git-credentials (secrets),
~/.claude/settings.json (per-box decision), fnm/opencode conf.d (out of scope),
and fish_variables (machine-local).

chezmoi tracks only the executable and private attributes and derives modes
from the umask, so setup.sh pins umask 022 and atuin uses private_ to keep
0700/0600. Without both, a 002 umask silently relaxes them to 0775/0664.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitignore

@@ -0,0 +1,8 @@
+# Secrets — never commit
+.git-credentials
+secrets.yml
+*.key
+
+# Editor / OS noise
+*.swp
+.DS_Store