Stop chezmoi clobbering app-written settings keys

[DROOdotFOO]

~/.claude/settings.json has two writers. chezmoi treated it as a plain managed
file, so it was authoritative and every chezmoi apply deleted whatever Claude
Code had written at runtime:

$ chezmoi diff ~/.claude/settings.json
-  "model": "opus",
-  "effortLevel": "xhigh",

That is the recurring MM in chezmoi status -- the file diverges in both
directions, so apply clobbers the app and re-add clobbers the repo.

Fix

Convert the source to a modify_ script. chezmoi pipes the current target
to it on stdin and takes stdout as the new target, so it can merge instead of
overwrite:

printf '%s' "$current" | jq --argjson managed "$managed" '. * $managed'

jq's * merges objects recursively with the right-hand side winning, so
managed keys stay authoritative while anything the app added survives -- today
model and effortLevel, tomorrow whatever /config gains.

Two properties worth calling out:

• Idempotent. chezmoi runs the script for status and diff, not just
  apply. If f(current) != current once converged, the file would report
  drift forever. Verified byte-identical output against the live file.
• Degrades safely. Empty stdin (fresh machine), invalid JSON, or missing
  jq all fall back to emitting the managed block. Emitting nothing would
  truncate settings.json.

The trade-off: a merge only ever adds, so deleting a key from the source no
longer deletes it from the target. Documented.

Also

**/.claude/settings.local.json had been added straight to ~/.gitignore_global,
so apply kept trying to delete it. Folded into the chezmoi source, with a comment
explaining what that file is.

CLAUDE.md gains the general pattern, the two constraints above, and the two
files still unconverted that are known to rewrite themselves: ~/.config/zed/settings.json
(Zed writes UI changes; strict JSON, so the same recipe applies) and ~/.gitconfig
(gh auth setup-git rewrites its credential blocks with tabs and a trailing
space -- INI, so jq does not apply).

Manual testing

Six cases against the rendered script:

• existing file on stdin -> model and effortLevel preserved
• output byte-identical to the live file (idempotent, no perpetual drift)
• empty stdin -> full managed config, 15 deny rules, hook paths expanded
• invalid JSON on stdin -> recovers to the managed block
• unrelated user key survives the merge
• managed key wins over a stale target value
• real chezmoi apply: runtime keys survived, managed keys correct, MM gone
• chezmoi status clean afterwards; only R script entries remain
• rendered script passes shellcheck; pre-commit passes

🤖 Generated with Claude Code