docs: README with bootstrap one-liner, prerequisites, age key distribution

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

@@ -0,0 +1,43 @@
+# dotfiles
+
+Managed with [chezmoi](https://chezmoi.io). One command on any machine:
+
+```sh
+sh -c "$(curl -fsLS get.chezmoi.io)" -- init --apply git@github.com:prdlk/dotfiles
+```
+
+First apply prompts once for name, email, and machine role
+(`desktop` | `laptop` | `mac` | `server`). Role gates the Linux desktop
+layer (niri, noctalia, fontconfig, systemd user units) — `mac` and
+`server` get the universal toolset only.
+
+## Prerequisites
+
+- **Arch**: `paru` for AUR packages (optional — the install script warns
+  and skips AUR if missing). `sudo` for pacman.
+- **macOS**: [Homebrew](https://brew.sh).
+- **Secrets**: `age`-encrypted files need the key at
+  `~/.config/chezmoi/key.txt`. Copy it there **before** `chezmoi apply`
+  (distributed manually, never committed):
+
+  ```sh
+  mkdir -p ~/.config/chezmoi
+  scp <existing-machine>:.config/chezmoi/key.txt ~/.config/chezmoi/key.txt
+  chmod 600 ~/.config/chezmoi/key.txt
+  ```
+
+## What's managed
+
+Universal: fish, nvim (AstroNvim), tmux, kitty, yazi, lazygit,
+lazydocker, gh (+ extensions), starship, git, ssh config, Claude Code
+(settings/commands/hooks/skills). Packages declared in
+`.chezmoidata/packages.yaml`, installed by `.chezmoiscripts` (idempotent,
+re-run when the manifest changes).
+
+Linux desktop (role `desktop`/`laptop` only): niri, noctalia,
+fontconfig, mimeapps, systemd user units, niri-launch.
+
+`gh` needs `gh auth login` once per machine; the extension install
+script skips gracefully until then, and re-runs on the next apply.
+
+See `MIGRATION-NOTES.md` for the dotstate → chezmoi migration record.