Place dotfiles with home-manager instead of chezmoi

Place dotfiles with home-manager instead of chezmoi Links the 18 managed paths from the worktree into $HOME. Verified against the README's managed list: 18 of 19 covered, the exception being the capslock LaunchAgent that the previous commit replaced with remapCapsLockToControl. Every link is an out-of-store symlink rather than a copy into /nix/store, because six of these files are written by the tools that read them: .zshrc (LM Studio appends a PATH block), .gitconfig (gh auth writes credential helpers), .ssh/config (the Upsun CLI writes a cert block), .config/gh/config.yml, nvim's lazy-lock.json, and .claude/settings.json. Store copies are read-only and would break all six. As a side effect those writes now land in the worktree, where git status shows them, instead of being silently overwritten on the next apply. Only .config/nvim is linked as a directory. Everything else is linked file by file, because the parent directories hold state this repo must not own: ~/.ssh has private keys, ~/.claude has daemon logs and caches, ~/.codex has auth and state, ~/.local/bin has hand-installed binaries. programs.zsh and programs.git are deliberately left off; they would generate files competing with the hand-written ones. backupFileExtension is set because $HOME still holds the real files chezmoi copied there, and the first activation would otherwise refuse to clobber them. Reorders the PATH array in .zshrc to put the Nix profiles ahead of Homebrew, so tool resolution is deterministic rather than dependent on Homebrew winning. Verified by building home-manager-files and following both symlink hops to the worktree, including that rtk-claude-hook arrives executable.