Host-specific divergence for blankpad deployed last with override semantics:
display layout (its own outputs, not Dankware's DP/eDP rig), autostart and
keybinds targeting the bare 'noctalia' CLI instead of qs -c noctalia-shell,
misc without renderD129, rules without the Noctalia floating-window rule, and
blank's own .zshrc. All other packages deploy canonical from base.
Import Dankware's environment layer into the repo as home-relative package
trees (niri, gtk-3/4, ghostty, alacritty, fish, zsh, bash, profile,
systemd-user, dconf). scripts/deploy.sh implements stow-equivalent semantics
(check|adopt|sync modes): identical files adopt to symlinks, new files link,
divergent files quarantine-and-replace under .quarantine/<host>/<ts>/ (gitignored).
zz-<hostname> override packages deploy last with override semantics.
Secrets never enter git: GITEA_TOKEN moved from .zshrc into untracked
~/.config/environment.d/secrets.env (0600); tracked .zshrc sources it
guarded. core.hooksPath armed by deploy.sh so the pre-commit secret gate is
live on every machine that deploys.
Frank