Hotfix: empty if/then/fi syntax error + /lb chezmoi bootstrap URL

[vaintrub]

Summary

Two follow-ups to PR #22 that landed AFTER the squash merge:

Critical: empty if/then/fi syntax error

On a first apply (e.g. jetson via SSH after chezmoi update post-merge), gh is not on PATH yet — mise installs it during this same apply. The wrapper's {{ if lookPath "gh" }} guard evaluates false at template render time, so the inner gh-auth block is omitted entirely, producing a syntactically invalid empty if/then/fi:

if [ -z "${GITHUB_TOKEN:-}" ]; then
fi

Shell errors: Syntax error: "fi" unexpected. Apply aborts before mise even runs.

Fix: switch the gh check from template-time lookPath to runtime command -v gh. Rendered output is always syntactically valid; gh path picks up on subsequent applies once mise has installed gh — same intent as the original template guard, just deferred render→exec.

chezmoi bootstrap URL → get.chezmoi.io/lb

Default get.chezmoi.io URL installs chezmoi to ./bin/<binary> (CWD-relative). For a user running the one-liner from $HOME, that lands at ~/bin/chezmoi. Ubuntu's ~/.profile adds ~/bin to PATH only IF the directory exists at login time, so a fresh install creates the directory mid-session and the running shell never picks it up — chezmoi: command not found after the bootstrap. Bit me on jetson.

Switch all four bootstrap one-liners to chezmoi's /lb URL variant (documented at chezmoi.io/install — lb = local bin). Installs directly to ~/.local/bin/chezmoi, which is XDG-standard, included in PATH by both ~/.profile and ~/.zprofile on Ubuntu/Debian, and almost always pre-existing.

Why a separate PR

PR #22 was squash-merged before I caught either issue. Branch had two additional commits beyond the merge point.

Test plan

• CI green on chore/secrets-architecture (run 25994759888)
• chezmoi execute-template on the wrapper renders valid syntax in both gh on PATH and gh not on PATH cases
• Jetson re-chezmoi update after merge → apply completes; pre-existing ~/bin/chezmoi migration documented for already-bitten machines (see commit msg)

Recovery for machines with ~/bin/chezmoi from the old URL

mv ~/bin/chezmoi ~/.local/bin/chezmoi
rmdir ~/bin 2>/dev/null