feat(server): carry shron's own configuration into the role file

Task 7 as planned would have checked out over shron and reviewed what was lost
afterwards. That is the wrong order for a machine whose .zshrc holds working
operational tooling: ipt-block, a CrowdSec whitelist helper, reboot_required,
the German locale and dircolors would all have been gone between the checkout
and the review.

Also found: shron runs ZSH_THEME="ys" and has no powerlevel10k. The theme
selection would have fallen through to oh-my-zsh's default, which is a
regression nobody asked for, so 05-pre-omz.zsh keeps ys where p10k is absent.
The red role colour is still set, but it is honest to say it does nothing there
until p10k is installed - the safeguard the role split was built around does
not currently apply to the one machine it was meant for.

05-prompt.zsh becomes 05-pre-omz.zsh: the theme was never the only thing that
has to precede oh-my-zsh. DISABLE_AUTO_UPDATE belongs there too - a server
should not go fetching updates on its own while somebody is logged in fixing
something - and the stub no longer sets the update mode itself.

update-blacklist is carried over with a note rather than silently: openbl.org
answers 301 and the curl call has no -L, so it has been reporting "Blacklist
download failed" for some time. CrowdSec covers that ground now, but the
iptables chain it created may still exist and is worth removing deliberately.

PYTHONPATH pointed at python3.4 on shron and at 3.9 on beastix. Neither
directory exists; neither is carried over.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.config/zsh/rc.d/05-pre-omz.zsh

@@ -0,0 +1,30 @@
+# Everything that has to be set before oh-my-zsh is sourced, and nothing else.
+#
+# oh-my-zsh reads the theme and its own settings while being sourced, so any of
+# these placed in a role file - which comes afterwards - is silently ignored.
+# The first attempt put ZSH_THEME in the role file and produced a shell that
+# reported the right value while running without powerlevel10k at all.
+#
+# The role COLOUR is deliberately NOT here. ~/.p10k.zsh assigns
+# POWERLEVEL9K_CONTEXT_BACKGROUND itself and is sourced later from
+# 30-path.zsh, so a colour set here is overwritten before the first prompt is
+# drawn. It belongs in the role files, which run after that.
+
+if [[ -d "${ZSH_CUSTOM:-$ZSH/custom}/themes/powerlevel10k" ]]; then
+  ZSH_THEME="powerlevel10k/powerlevel10k"
+elif [[ "$ROLE" == "server" ]]; then
+  # What shron already used. Without this it would silently fall back to
+  # oh-my-zsh's default, which is a change nobody asked for.
+  ZSH_THEME="ys"
+fi
+
+case "$ROLE" in
+  server)
+    # A server should not decide on its own to go fetching updates while
+    # someone is logged in trying to fix something.
+    DISABLE_AUTO_UPDATE="true"
+    ;;
+  *)
+    zstyle ':omz:update' mode auto
+    ;;
+esac