fix(shell): guard brew shellenv against TCC and keep eza aliases

.zshenv runs brew shellenv for every zsh, including non-interactive and
GUI-launched shells; without a safe CWD the eval fails or triggers a
permission prompt when launched from a TCC-protected directory such as
~/Documents. Run it from /tmp.

The eza `l` alias (and the myip/e/ip/a/aa group) was defined before
oh-my-zsh loaded, so lib/directories.zsh overrode `l` back to ls. Move
the alias block after the oh-my-zsh source so the eza versions win.

Also document the ~/.config/zshrc personal-config mechanism and patch.sh
in the README, which previously only had a title.

Co-authored-by: Cursor <cursoragent@cursor.com>

README.md

@@ -1 +1,40 @@
-# Easy Zsh Setup
+# Easy Zsh Setup
+
+One-command zsh environment: oh-my-zsh, powerlevel10k, and a curated plugin set
+(autosuggestions, syntax-highlighting, completions, history-substring-search,
+fzf-tab, k), plus eza, zoxide, fzf, and Nerd Fonts.
+
+## Install
+
+```bash
+curl -fsSL https://git.miomio.moe/mio/easyzsh/raw/branch/master/install.sh | bash
+```
+
+Options: `--cp-hist` / `-c` imports bash history; `--non-interactive` / `-n`
+skips the default-shell change. The installer backs up an existing `~/.zshrc`
+and `~/.zshenv` before replacing them.
+
+## Personal configuration
+
+`~/.zshrc` is meant to stay close to this repo's canonical version. Put your own
+tweaks in `~/.config/zshrc/` instead of editing `~/.zshrc` directly: every
+`*.zsh` file there is sourced near the end of `~/.zshrc`, just before oh-my-zsh
+loads, so it can add plugins and override defaults.
+
+```bash
+# ~/.config/zshrc/my.zsh
+plugins+=(zsh-nvm)                 # add plugins
+plugins=(${plugins:#zsh-autosuggestions})   # or remove one
+alias gs='git status'
+```
+
+Ready-made configs from this repo's `zshrc/` directory (`fnm`, `nvm`, `pyenv`,
+`merlin_devbox`, `merlin_worker`, `personal`, `p10k`) can be pulled in by name:
+
+```bash
+curl -fsSL https://git.miomio.moe/mio/easyzsh/raw/branch/master/patch.sh | bash -s -- fnm pyenv
+```
+
+Because these files load before oh-my-zsh, plugin and theme changes take effect;
+aliases that must beat oh-my-zsh's own should be defined after oh-my-zsh loads
+(see the note in `~/.zshrc`).