Refactor dotfiles into app-oriented configuration

[zimakki]

Summary

• organize managed configuration under config/<app>/ with transitional root compatibility links
• add guarded, staged bootstrap migration for static links and mutable Claude/Karabiner JSON
• simplify Atuin, Television, Zsh, and the Brew inventory
• consolidate current documentation and align maintenance skills with the new ownership model
• remove obsolete reports, generated defaults, and unrelated repository artifacts
• add isolated bootstrap coverage and tracked-tree secret scanning

Migration safety

• bootstrap refuses canonical-machine mutations from linked worktrees, including partial runs
• old HOME links are normalized to direct declared sources before compatibility anchors can be removed
• Claude and Karabiner legacy snapshots preserve unmanaged state during the first overlay migration
• root compatibility links remain intentionally and should be removed only after every managed machine verifies twice
• no Git history rewrite is included

Validation

• scripts/ci_checks.sh
• isolated static-link, JSON-overlay, Lazygit, conflict, idempotence, and failure-propagation tests
• ShellCheck plus JSON, TOML, YAML, Python, Zsh, and Brewfile syntax checks
• native Atuin, Television, Starship, Bat, Ghostty, Git, and Lazygit config loading
• Gitleaks current tracked-tree scan