feat: split zshrc into a stub and role-aware fragments

Load order is the substance of this change, and two attempts got it wrong in
the same way. oh-my-zsh consumes both the plugins array and the theme while it
is being sourced, so anything set afterwards is silently ignored. The plan had
plugins in the stub but the theme in the role file, which produced a shell
reporting ZSH_THEME=powerlevel10k while running without powerlevel10k at all -
132 of its functions missing and nobody any the wiser. Plugins and prompt are
now both resolved before oh-my-zsh, the latter in 05-prompt.zsh.

Portability is handled by asking whether a command exists rather than by
duplicating files per role. "alias ls='lsd'" turns ls into a broken command on
a machine without lsd, and the Mac is such a machine; the yay aliases and
helpers are gated the same way. That keeps one shared base instead of three
diverging copies.

The plan also guessed the plugin list as (git fzf). It is actually seven
entries, so five would have vanished - among them signal-keyring, which turned
out to be a local custom plugin present on this machine only. Naming it
elsewhere means an oh-my-zsh warning at every login, and its content is a
verbatim copy of the gnome-keyring block already in .zshrc, so it ran twice.
The inline block stays, in the desktop role; the plugin is dropped.

Dead code removed rather than carried over:
  - PYTHONPATH pointed at /usr/lib/python3.9/site-packages. Python here is
    3.14 and that directory does not exist.
  - XDG_SESSION_TYPE was forced to x11 and then tested for "wayland" six lines
    below, so that branch could never be taken. The variable belongs to the
    session; overriding it lies to everything that reads it.
  - drm() was defined twice, the first losing to the second on every start.
  - PATH carried ~/bin, ~/.scripts and /usr/X11R6/bin, none of which exist.
    Entries are added only if the directory is there.

Verified against the live configuration in an isolated ZDOTDIR: 277 aliases and
263 functions on both sides, none missing, and powerlevel10k loading for all
three roles with the intended colour.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.config/zsh/rc.d/30-path.zsh

@@ -0,0 +1,45 @@
+# PATH and environment shared by every machine.
+#
+# Entries are added only if the directory exists. The list this replaces
+# carried ~/bin, ~/.scripts and /usr/X11R6/bin, none of which are present on
+# this machine - a PATH full of missing directories costs a stat on every
+# lookup and hides the fact that something was never installed.
+#
+# It also exported PYTHONPATH=/usr/lib/python3.9/site-packages. Python here is
+# 3.14 and that directory does not exist; pointing PYTHONPATH at a missing
+# 3.9 tree is at best inert and at worst confusing, so it is gone.
+
+# $HOME rather than a hardcoded /home/templis: the Mac puts it under /Users.
+_path_add() {
+  [[ -d "$1" ]] || return 0
+  case ":$PATH:" in
+    *":$1:"*) ;;
+    *) PATH="$1:$PATH" ;;
+  esac
+}
+
+_path_add "$HOME/.local/bin"     # pipx
+_path_add "$HOME/perl5/bin"      # local::lib
+_path_add "$HOME/bin"
+_path_add "$HOME/.scripts"
+export PATH
+unfunction _path_add
+
+# local::lib, only where it is actually set up.
+if [[ -d "$HOME/perl5/lib/perl5" ]]; then
+  export PERL5LIB="$HOME/perl5/lib/perl5${PERL5LIB:+:${PERL5LIB}}"
+  export PERL_LOCAL_LIB_ROOT="$HOME/perl5${PERL_LOCAL_LIB_ROOT:+:${PERL_LOCAL_LIB_ROOT}}"
+  export PERL_MB_OPT="--install_base \"$HOME/perl5\""
+  export PERL_MM_OPT="INSTALL_BASE=$HOME/perl5"
+fi
+
+export FZF_DEFAULT_OPTS='--height 40% --layout=reverse --border'
+
+# ghostty announces itself but its terminfo is not everywhere, which leaves
+# remote hosts unable to draw anything.
+if [[ "$TERM_PROGRAM" == "ghostty" ]]; then
+    export TERM=xterm-256color
+fi
+
+# powerlevel10k's own configuration, where it exists.
+[[ ! -f "$HOME/.p10k.zsh" ]] || source "$HOME/.p10k.zsh"