Keep .bashrc a bootstrap, and secrets out of the checkout for real

.bashrc is back to its one job: export the Panama paths and source
what it finds. The personal-env block moves into config/bash/shell —
first, because the tmux guard below it reads that file — and the
cargo source that was duplicated between the two files lives only in
shell now.

The real fix is behind that tidying: both Home Assistant helpers
defaulted to the IN-REPO config/bash/env, and the writer rebuilt it
with only its own three lines — which read as "my env vars vanished"
to the person who thought that file was hand-maintained. Both now
prefer ~/.config/panama/env, the migrated home outside the checkout,
with the repo path kept only as a read fallback for unmigrated
machines. The stale legacy copy on this machine is retired; the
working credentials were merged into the migrated file first, after
probing both sets against the live Home Assistant.

Claude-Session: https://claude.ai/code/session_01Ms2FbjQy31TVf3CEvQhGM8

config/bash/.bashrc

@@ -5,11 +5,11 @@ export PANAMA_BASH="$PANAMA_PATH/config/bash"
 [ -f /etc/bashrc ] && . /etc/bashrc
 
 if [ -d ~/.bashrc.d ]; then
-    for rc in ~/.bashrc.d/*; do
-        if [ -f "$rc" ]; then
-            . "$rc"
-        fi
-    done
+  for rc in ~/.bashrc.d/*; do
+    if [ -f "$rc" ]; then
+      . "$rc"
+    fi
+  done
   unset rc
 fi
 
@@ -18,26 +18,9 @@ if [ -d "$PANAMA_BASH" ]; then
     [ -f "$f" ] && . "$f"
   done
   unset f
-
-  # Personal environment -- API keys, tokens -- lives OUTSIDE the checkout,
-  # where agents, backup tools and `panama update` walk, and is kept
-  # owner-only every time it is read: a secrets file that drifts to 644 is
-  # quietly re-tightened rather than trusted. (config/bash/env, its old home
-  # inside the repo, is still sourced by the glob above if a machine has not
-  # been migrated yet.)
-  PANAMA_ENV="${XDG_CONFIG_HOME:-$HOME/.config}/panama/env"
-  if [ -f "$PANAMA_ENV" ]; then
-    [ "$(stat -c %a "$PANAMA_ENV" 2>/dev/null)" = "600" ] || chmod 600 "$PANAMA_ENV"
-    . "$PANAMA_ENV"
-  fi
-  unset PANAMA_ENV
 else
   if ! [[ "$PATH" =~ "$HOME/.local/bin:$HOME/bin:" ]]; then
     PATH="$HOME/.local/bin:$HOME/bin:$PATH"
   fi
   export PATH
 fi
-# rustup writes this file, and initial-packages installs rustup rather than
-# running rustup-init -- so on a fresh machine it does not exist yet and an
-# unguarded source made every single shell start with an error.
-[ -f "$HOME/.cargo/env" ] && . "$HOME/.cargo/env"