feat(dotfiles): import env layer as stow-style packages with deploy.sh

Import Dankware's environment layer into the repo as home-relative package
trees (niri, gtk-3/4, ghostty, alacritty, fish, zsh, bash, profile,
systemd-user, dconf). scripts/deploy.sh implements stow-equivalent semantics
(check|adopt|sync modes): identical files adopt to symlinks, new files link,
divergent files quarantine-and-replace under .quarantine/<host>/<ts>/ (gitignored).
zz-<hostname> override packages deploy last with override semantics.

Secrets never enter git: GITEA_TOKEN moved from .zshrc into untracked
~/.config/environment.d/secrets.env (0600); tracked .zshrc sources it
guarded. core.hooksPath armed by deploy.sh so the pre-commit secret gate is
live on every machine that deploys.

README.md

@@ -23,6 +23,8 @@ Dankware is the primary host — this repository lives at `~/.omp/` and drives t
 │   ├── managed-skills/ # Managed skills (SKILL.md bundles)
 │   ├── models.db       # Model cache
 │   └── sessions/       # Persistent session state
+├── dotfiles/           # stow-style env-layer packages (home-relative trees)
+│   └── deploy via scripts/deploy.sh (check|adopt|sync; quarantine-and-replace)
 ├── omp-docs/           # Knowledge base (source of truth)
 │   ├── index.md        # KB index — start here
 │   ├── system/         # Fleet hardware, OS, network