refactor: consolidate all branches into single-branch Strategy 1

- bash/.bashrc: replace oh-my-bash with minimal unified config
  sources common → aliases → OS overlay → .bashrc.local

- zsh/.zshrc: remove hardcoded macOS PATHs (moved to macos overlay)
  clean sourcing order: common → personal → aliases → OS → .zshrc.local

- shell/common: populated with universal exports (EDITOR, HISTSIZE, etc.)
- shell/macos: Homebrew, Antigravity, Flutter PATH, fzf init, macOS aliases
- shell/linux: xdg-open, xclip, fzf init for Linux

- nvim/plugins/work.lua: Copilot plugin (migrated from origin/work branch)
- nvim/plugins/_init.lua: conditional load via DOTFILES_PROFILE=work env var

- tmux/.tmux.conf.local: per-machine override hook (~/.tmux.conf.machine.local)

- bootstrap.sh: one-command new machine setup with profile support
  usage: bash bootstrap.sh [personal|work]

- .gitignore: comprehensive .local file ignore patterns

All branches (linux, mac, work, linux_personal, linux_work, mac_personal)
can now be deleted — all unique content is merged into master.

.gitignore

@@ -1,2 +1,15 @@
+# ── Neovim lock file ──────────────────────────────────────────────────────────
 *nvim/.config/nvim/lazy-lock.json*
+
+# ── OS clutter ────────────────────────────────────────────────────────────────
 .DS_Store
+Thumbs.db
+
+# ── Per-machine local overrides (Strategy 1: Dynamic Runtime Sourcing) ────────
+# These files are stowed/created on each machine but never committed.
+# They contain secrets, host-specific paths, work credentials, etc.
+**/*.local
+**/.zshrc.local
+**/.tmux.conf.local
+**/.gitconfig.local
+**/.env.local