feat(dotfiles): import env layer as stow-style packages with deploy.sh

Import Dankware's environment layer into the repo as home-relative package
trees (niri, gtk-3/4, ghostty, alacritty, fish, zsh, bash, profile,
systemd-user, dconf). scripts/deploy.sh implements stow-equivalent semantics
(check|adopt|sync modes): identical files adopt to symlinks, new files link,
divergent files quarantine-and-replace under .quarantine/<host>/<ts>/ (gitignored).
zz-<hostname> override packages deploy last with override semantics.

Secrets never enter git: GITEA_TOKEN moved from .zshrc into untracked
~/.config/environment.d/secrets.env (0600); tracked .zshrc sources it
guarded. core.hooksPath armed by deploy.sh so the pre-commit secret gate is
live on every machine that deploys.

dotfiles/zsh/.zshrc

@@ -0,0 +1,31 @@
+source /usr/share/cachyos-zsh-config/cachyos-config.zsh
+
+# To customize prompt, run `p10k configure` or edit ~/.p10k.zsh.
+[[ ! -f ~/.p10k.zsh ]] || source ~/.p10k.zsh
+
+if [ -n "${GHOSTTY_RESOURCES_DIR}" ]; then
+    builtin source "${GHOSTTY_RESOURCES_DIR}/shell-integration/zsh/ghostty-integration"
+fi
+
+# Bun 
+export PATH="/home/dank/.bun/bin:$PATH"
+
+export NVM_DIR="$HOME/.nvm"
+[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"  # This loads nvm
+[ -s "$NVM_DIR/bash_completion" ] && \. "$NVM_DIR/bash_completion"  # This loads nvm bash_completion
+
+# CUDA toolkit + llama.cpp
+export PATH="/opt/cuda/bin:/home/dank/GitPackages/llama.cpp/build/bin:$PATH"
+export LD_LIBRARY_PATH="/opt/cuda/lib64:/home/dank/GitPackages/llama.cpp/build:$LD_LIBRARY_PATH"
+
+# GiTea
+
+# Terminal Aliases
+alias systemprompt="nvim ~/.pi/agent/SYSTEM.md"
+
+# peon-ping quick controls
+alias peon="bash /home/dank/.claude/hooks/peon-ping/peon.sh"
+[ -f /home/dank/.claude/hooks/peon-ping/completions.bash ] && source /home/dank/.claude/hooks/peon-ping/completions.bash
+
+# machine-local secrets, never tracked
+[ -f "$HOME/.config/environment.d/secrets.env" ] && source "$HOME/.config/environment.d/secrets.env"