refactor(shell): thin stubs with managed ~/.config/zsh tree

Split always-on PATH/env, login hooks, and interactive UX into a
managed tree under ~/.config/zsh, with never-overwrite local/ hooks.
Agents and interactive shells share one PATH owner; deploy.sh applies
the layout safely across machines.

.zshenv

@@ -1,26 +1,20 @@
-# Homebrew on macOS. .zshenv runs for every zsh (interactive, scripts, GUI-launched),
-# and brew shellenv needs a readable CWD: cd to a safe dir first so launching from a
-# TCC-protected directory (e.g. ~/Documents) does not break the eval or prompt for access.
-if [ -x /opt/homebrew/bin/brew ]; then
-    eval "$(cd /tmp && /opt/homebrew/bin/brew shellenv)"
-elif [ -x /usr/local/bin/brew ]; then
-    eval "$(cd /tmp && /usr/local/bin/brew shellenv)"
+# easyzsh stub: every zsh loads this. Keep it thin; logic lives under ~/.config/zsh/.
+# Machine-local early env: ~/.config/zsh/local/env.local.zsh (never overwritten).
+EASYZSH_HOME="${XDG_CONFIG_HOME:-$HOME/.config}/zsh"
+
+if [[ -d "$EASYZSH_HOME/env" ]]; then
+  for _easyzsh_f in "$EASYZSH_HOME/env"/*.zsh(N); do
+    # shellcheck disable=SC1090
+    . "$_easyzsh_f"
+  done
+  unset _easyzsh_f
 fi
 
-# User-local binaries (pipx, uv tools, grok CLI, etc.).
-# Lives here rather than .zshrc/.zprofile so non-interactive agent shells
-# (Codex, Claude Code, CI zsh -c) still resolve user-installed tools.
-if [ -d "$HOME/.local/bin" ]; then
-    case ":${PATH}:" in
-        *":$HOME/.local/bin:"*) ;;
-        *) PATH="$HOME/.local/bin:${PATH}" ;;
-    esac
-    export PATH
-fi
-
-# Machine-local early env (cargo, private PATH bits). Survives easyzsh reinstalls
-# of this file. Prefer this over editing ~/.zshenv by hand.
-if [ -f "$HOME/.config/zshenv.local" ]; then
-    # shellcheck disable=SC1090,SC1091
-    . "$HOME/.config/zshenv.local"
+if [[ -f "$EASYZSH_HOME/local/env.local.zsh" ]]; then
+  # shellcheck disable=SC1090
+  . "$EASYZSH_HOME/local/env.local.zsh"
+elif [[ -f "$HOME/.config/zshenv.local" ]]; then
+  # Legacy path from earlier easyzsh layouts.
+  # shellcheck disable=SC1090
+  . "$HOME/.config/zshenv.local"
 fi