Dotfiles with Chezmoi and Age

My macOS environment lives in a single git repo managed by [chezmoi](https://www.chezmoi.io/), with secrets encrypted at rest using [age](https://github.com/FiloSottile/age). Bootstrapping a new machine is one script and one manual step: restoring the age key. I started with the Bitwarden CLI feeding chezmoi's secret templates, then migrated to age. The April 2026 Bitwarden CLI supply chain attack…