feat: profile-axis plugin layers, PATH baseline for non-login shells

[altaywtf]

Problem

Agent harness shells lost /usr/bin after a dotfiles apply because only login shells run path_helper. The ffsstack plugin lived on the personal layer while the work workstation also needs it, and layer names ("shared", "coding") did not match how profiles actually compose.

Solution

• .zshenv appends the system directories as the lowest-precedence PATH baseline and exports it, covering shells that started with no PATH at all.
• Skill and plugin manifests are named for the profile axes: {developer,workstation,devbox,personal}.json. "shared" was never shared beyond developer machines, and runtimeGroup: developer already names that set. Profiles compose their axes; identical entries across axes install once; duplicates inside one manifest fail closed.
• ffsstack ships on the workstation and personal layers: both personal machines and the work workstation get it, the plain devbox does not.

Proof

The broken state reproduced as a harness shell whose PATH was homebrew + android only; with the exported baseline, env -i HOME=$HOME /bin/zsh -c 'command -v sed' resolves.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This pull request fixes missing system binaries in non-login zsh processes by establishing a lowest-precedence PATH baseline in .zshenv, and refactors agent skill/plugin layering to align with profile “axes” (shared/workstation/devbox/personal) so profiles compose layers and identical selections can collapse to a single install.

Changes:

• Append core system directories to PATH (lowest precedence) for all zsh processes via chezmoi/dot_zshenv.
• Rename/expand agent skill + plugin layers to shared/workstation/devbox/personal and update profile model + docs accordingly.
• Adjust agent sync logic and tests to support composed layers and collapsing identical selections; move ffsstack to workstation + personal plugin layers.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
scripts/verify/vendor-neutral.sh	Updates vendor-neutral allowlist patterns for the new skill/plugin manifest layer files.
scripts/profiles/model.ts	Expands the allowed skillLayers set/type to include workstation and devbox axes.
scripts/agents/sync.ts	Reads additional skill layers and collapses duplicate skill selections across composed layers.
scripts/agents/sync.test.ts	Updates fixtures and assertions for the new layer composition behavior.
scripts/agents/skills/workstation.json	Adds an (empty) workstation skill layer manifest.
scripts/agents/skills/devbox.json	Adds an (empty) devbox skill layer manifest.
scripts/agents/plugins/workstation.json	Adds workstation plugin layer and ships ffsstack there.
scripts/agents/plugins/devbox.json	Adds an (empty) devbox plugin layer manifest.
scripts/agents/plugins.ts	Reads additional plugin layers and collapses identical plugin selections across composed layers.
scripts/agents/plugins.test.ts	Extends tests for new layer composition and ffsstack placement across layers.
docs/agents.md	Documents the new axis-based layering model and composition rules.
chezmoi/dot_zshenv	Adds a PATH baseline for non-login shells (agent harnesses, zsh -c, etc.).
chezmoi/.chezmoidata/profiles.json	Updates profiles to compose the new skill layer axes (workstation/devbox/personal).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[slopzapper]

✨ CLEAN

The profile-axis skill and plugin layers, identical-entry collapse, ffsstack placement, and zshenv system PATH baseline match the updated contracts and tests.