audit + modernize dotfiles

[lukasjuhas]

Summary

A full pass over the dotfiles based on what's actually used today.
Net result: 76 files changed, ~1218 insertions / ~1598 deletions
(~380 lines smaller).

What changed

Fix breaking bugs in setup

The setup script had several breaks that meant it could no longer
complete cleanly on a fresh machine:

• misc.sh: 7 broken brew install "Readable Name" "pkg" "--cask"
  calls (which tried to install packages literally named "Docker",
  "MeetingBar", "Cursor", etc.) → switched to the brew_install helper
• browsers.sh: dropped the deprecated homebrew/cask-versions tap
  (removed Aug 2023). Chrome Canary / FF Dev/Nightly / Safari TP /
  Chromium installs would all fail without this
• misc.sh: dropped the deprecated homebrew/cask-fonts tap
  (untapped Oct 2023; fonts now live in the main cask)
• vscode.sh: stray trailing colon on print_in_purple (file now
  retired as VS Code moves into the Brewfile)
• Homebrew analytics opt-out now uses the modern
  HOMEBREW_NO_ANALYTICS=1 env var instead of the legacy git-config
  approach

Brewfile (declarative installs)

Replaces 11 imperative install scripts with one root Brewfile
(45 formulae, 29 casks, 3 MAS apps, 1 tap).

Retired scripts: browsers.sh, cli_tools.sh, misc.sh, git.sh,
tmux.sh, gpg.sh, compression_tools.sh, image_tools.sh,
video_tools.sh, web_font_tools.sh, misc_tools.sh.

New src/os/installs/macos/brewfile.sh runs brew bundle against
the root Brewfile. justfile gets bundle, bundle-check,
bundle-dump recipes.

Added (apps in active use, not previously managed): claude,
chatgpt, block-goose, granola, linear-linear, jordanbaird-ice (Ice),
mongodb-compass, postman, mole (Mac cleanup).
CLI quality of life: fzf, ripgrep, bat, eza, fd, zoxide,
git-delta, direnv, gh, lazygit, just, awscli, terraform, tflint,
ruff, watchman, zellij, pnpm.
Removed: dozer, bartender, transmit, transmission, loom, Chrome
Canary, Firefox Dev/Nightly, Chromium, Safari TP, Adobe CC.

Vim → minimal, plugin-free

The bulk of the "tracked files keep reappearing" complaint had a
real root cause: 22 plugin folders were tracked as git submodule
gitlinks but the repo had no .gitmodules. Each plugin
checkout drifting on disk showed up as M forever, with no way to
resolve.

This PR removes all 33 phantom gitlink entries via
git update-index --force-remove (plain git rm refuses without
.gitmodules), then physically deletes the directories. The vimrc
shrinks from 740 → ~140 lines of plugin-free sane defaults, and
sources ~/.vimrc.local at the end. Rationale: day-to-day editing
happens in Cursor/VS Code; vim is for quick terminal edits and
doesn't need a plugin ecosystem.

Shared VS Code + Cursor config

New src/vscode/ directory holds a single shared settings.json,
keybindings.json, and snippets/. link_vscode_configs.sh
symlinks them into both editors' User dirs and backs up any
pre-existing real files. Unknown keys (cursor.* in VS Code,
claudeCode.* in Cursor) are silently ignored by the editor that
doesn't know them, so one shared file works.

Git hygiene

• Removed the committed name/email from gitconfig — these now
  live in the (gitignored) ~/.gitconfig.local, matching the file's
  own comment block warning
• Replaced hardcoded /opt/homebrew/bin/gh credential helper with
  bare gh
• Added modern git options: [pull] rebase = true, [rerere],
  [branch] sort = -committerdate, [fetch] prune = true,
  [core] pager = delta + [delta] config block

Shell config cleanup

• Moved the pnpm-PATH hack out of bashrc into bash_exports with
  an idempotent guard
• Added zoxide, direnv, fzf shell integrations (only loaded
  if installed)
• Deduplicated ip alias, trimmed the update alias of dead
  composer/gem commands, fixed dc/dcc to use modern
  docker compose (v2)
• Added lg → lazygit, gs → git status, pn → pnpm

macOS preferences

• New init.sh prompts for Full Disk Access before defaults write
  calls (silently fails without it on modern macOS)
• ui_and_ux.sh: fixed typos, added Stage Manager disable,
  desktop-widget hiding, click-to-reveal-desktop off
• Commented out destructive defaults (force hostname → "laptop",
  force Bluetooth off) so they don't auto-run on next setup
• Removed dead Terminal.app theme files (you use Cursor/Warp, not
  Terminal.app)

Apple Silicon + Tahoe only

• MINIMUM_MACOS_VERSION bumped from 10.10 → 26.0 (Tahoe)
• homebrew.sh: dropped arm64/x86_64 detection, hardcoded
  /opt/homebrew
• VS Code/Cursor settings.json: eslint.nodePath updated from
  /usr/local/lib/node_modules (Intel npm path) →
  /opt/homebrew/lib/node_modules

Repo health

• tmux.conf: tmux-256color + truecolor RGB overrides;
  removed obsolete reattach-to-user-namespace shim
• Added .editorconfig at repo root
• .gitignore: added .env*, .envrc, *.local, .backup.*,
  Python/build artifacts, common editor dirs
• renovate.json: enabled dependency dashboard, weekly schedule,
  semantic commits, automerge for non-major GitHub Actions updates,
  timezone America/New_York
• GitHub workflows: minimal permissions: blocks,
  branch/PR-scoped triggers, dropped redundant link-check on every
  push (the weekly cron handles it)
• Renamed README.MD → README.md (case-sensitive on Linux runners)
  and rewrote it end-to-end: new "What's inside" tree, "Common
  commands" section for just, "Editor configs" section, updated
  examples
• Added missing LICENSE.txt (was referenced in README, never existed)
• New justfile with one-line recipes: setup, install, bundle,
  prefs, link, link-editors, update, lint, check

Test plan

• shellcheck passes on all .sh files
• markdownlint passes on all .md files
• Brewfile parses cleanly (Ruby syntax check)
• All 34 scripts dispatched by setup.sh exist
• All 9 paths referenced by justfile exist
• All 13 internal README links resolve
• VS Code/Cursor settings.json + keybindings.json parse as
  valid JSONC
• All 23 CLI formulae and 12 cask names verified to exist in
  homebrew-core (brew info --formula/--cask)
• No backticks in shell scripts (prefer $(...))
• No unquoted $HOME / $PATH expansions in changed files
• No remaining references to deleted scripts anywhere in repo
• No duplicate aliases in bash_aliases
• No duplicate brew/cask entries in Brewfile
• gitconfig parses with git config --file ... --list
• renovate.json is valid JSON
• Workflow YAML parses

To exercise on a fresh machine: just setup (or, manually,
bash src/os/setup.sh).