chezmoi v2: omz + p10k + fzf + vi-mode zsh, tmux, per-account gitconfig (#612)

Rewrote the Aug-1 sandbox-era source into a full workstation setup for
both ultix-streaming accounts: oh-my-zsh with autosuggestions/
syntax-highlighting/completions + powerlevel10k (pinned externals),
fzf wiring, vi mode, tmux conf, aliases under ~/.config/zsh, gitconfig
template that keeps hooksPath/tea for reachableceo only.

Detail + verification: https://projects.knownelement.com/issues/612#note-3335

README.md

@@ -0,0 +1,37 @@
+# dotfiles
+
+Chezmoi-managed dotfiles for the ultix-streaming (VM 5111) human
+accounts: `reachableceo` and `reachableceo-offstage`.
+
+- Redmine work item: https://projects.knownelement.com/issues/612
+- Discourse doc (design + rationale):
+  https://community.turnsys.com/t/314
+
+## What's managed
+
+- `~/.zshrc` — oh-my-zsh + powerlevel10k + autosuggestions /
+  syntax-highlighting / completions, vi mode, fzf, history prefs
+- `~/.config/zsh/` — aliases.sh, variables.sh (personal snippets)
+- `~/.p10k.zsh` — lean theme, compatible glyphs (run `p10k configure`
+  on a nerd-font terminal to upgrade)
+- `~/.tmux.conf` — Ctrl-a prefix, mouse, vi copy mode
+- `~/.vimrc`, `~/.gitconfig` (template: hooksPath + tea helper render
+  only for `reachableceo`)
+- `~/.config/crush/crush.json`
+
+oh-my-zsh, plugins, and powerlevel10k come from pinned archives via
+`.chezmoiexternal.toml` (chezmoi fetches them at apply time).
+
+## Usage
+
+    chezmoi apply          # apply changes (source: ~/projects/dotfiles)
+    chezmoi edit <file>    # edit a managed file in the source
+    chezmoi re-add         # refresh source from live state
+
+Edit source -> `chezmoi apply` -> commit -> push.
+
+`reachableceo-offstage` applies from a local clone (no gitea creds on
+that account); refresh it as root:
+
+    sudo cp -r ~reachableceo/projects/dotfiles ~reachableceo-offstage/projects/
+    sudo chown -R reachableceo-offstage:reachableceo-offstage ~reachableceo-offstage/projects/dotfiles