feat: senior-grade dotfiles with chezmoi + sops/age

[haongo138]

Summary

Bootstrap a reproducible, secret-safe macOS dev environment for an AI-native fullstack stack (React/TS · Go · Postgres · devbox + colima · Claude Code).

• chezmoi as source of truth (source dir = this repo); machine vars prompted via .chezmoi.toml.tmpl
• sops/age secret pipeline — secrets encrypted in-repo, private key never committed; npm auth injected at apply time via dot_npmrc.tmpl
• git identity templated; the previously-exposed GitHub token was removed in favor of the gh credential helper
• Migrated configs: zsh, git, tmux, starship, ghostty, yazi, htop, gh, and Claude Code settings + go/ts/common rules
• Reproducible packages: packages/Brewfile (59 brews / 3 casks) + devbox.global.json
• Idempotent bootstrap: run_onchange script (Homebrew, oh-my-zsh, devbox global, nvm, tmux TPM)
• Quality gates: gitleaks CI + pre-commit, chezmoi apply --dry-run job, justfile task runner

Security

• No plaintext secrets in the repo (verified: gitleaks-clean working tree + staged content)
• age private key lives only at ~/.config/sops/age/keys.txt, git-ignored
• .chezmoiignore keeps secrets/, packages/, and repo-meta files out of $HOME

Test plan

• chezmoi status clean except intentional (run_onchange script, sops-rendered .npmrc)
• sops encrypt/decrypt roundtrip verified with zero plaintext leak
• chezmoi apply succeeds (only file-mode normalization on this machine)
• secret gate: 0 hits in repo and staged content
• Reviewer: add repo secret SOPS_AGE_KEY to enable the CI apply-dry-run job

Follow-ups (owner action)

• Revoke the previously-exposed gho_ GitHub token, then store a fresh one via just secrets
• Back up ~/.config/sops/age/keys.txt to a password manager