Keep .bashrc a bootstrap, and secrets out of the checkout for real

.bashrc is back to its one job: export the Panama paths and source
what it finds. The personal-env block moves into config/bash/shell —
first, because the tmux guard below it reads that file — and the
cargo source that was duplicated between the two files lives only in
shell now.

The real fix is behind that tidying: both Home Assistant helpers
defaulted to the IN-REPO config/bash/env, and the writer rebuilt it
with only its own three lines — which read as "my env vars vanished"
to the person who thought that file was hand-maintained. Both now
prefer ~/.config/panama/env, the migrated home outside the checkout,
with the repo path kept only as a read fallback for unmigrated
machines. The stale legacy copy on this machine is retired; the
working credentials were merged into the migrated file first, after
probing both sets against the live Home Assistant.

Claude-Session: https://claude.ai/code/session_01Ms2FbjQy31TVf3CEvQhGM8

config/bash/shell

@@ -1,5 +1,18 @@
 #!/usr/bin/env bash
 
+# Personal environment -- API keys, tokens -- lives OUTSIDE the checkout,
+# where agents, backup tools and `panama update` walk, and is kept owner-only
+# every time it is read: a secrets file that drifts to 644 is quietly
+# re-tightened rather than trusted. Sourced first, because settings below
+# (PANAMA_SSH_TMUX) read it. (config/bash/env, its old home inside the repo,
+# is still sourced by .bashrc's glob if a machine has not been migrated yet.)
+PANAMA_ENV="${XDG_CONFIG_HOME:-$HOME/.config}/panama/env"
+if [ -f "$PANAMA_ENV" ]; then
+  [ "$(stat -c %a "$PANAMA_ENV" 2>/dev/null)" = "600" ] || chmod 600 "$PANAMA_ENV"
+  . "$PANAMA_ENV"
+fi
+unset PANAMA_ENV
+
 # Editor used by CLI
 export EDITOR="nvim"
 export SUDO_EDITOR="$EDITOR"
@@ -22,6 +35,11 @@ export DOTNETPATH="$HOME/.dotnet/tools"
 # Set complete path
 export PATH="$HOME/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PANAMA_PATH/bin:$BUN_INSTALL/bin:$CARGO_PATH/bin:$PNPM_HOME/bin:$PYENV_ROOT/bin:$HOME/.rbenv/bin:/usr/lib/ccache/bin/:$GOPATH/bin:$DOTNETPATH"
 
+# rustup writes this file, and initial-packages installs rustup rather than
+# running rustup-init -- so on a fresh machine it does not exist yet and an
+# unguarded source made every single shell start with an error.
+[ -f "$HOME/.cargo/env" ] && . "$HOME/.cargo/env"
+
 # Nvm. Guarded because the file belongs to the nvm package: before that is
 # installed it does not exist, and an unconditional source means every shell on
 # a fresh machine opens with an error.
@@ -42,8 +60,8 @@ export PROMPT_COMMAND="${PROMPT_COMMAND:+$PROMPT_COMMAND; }_nvm_auto_use"
 # work is the point), but guarded: it must not replace the shell of someone
 # whose machine lacks tmux, and PANAMA_SSH_TMUX=off turns it off for people
 # who want a plain shell -- set it in ~/.config/panama/env.
-if [[ -n "$SSH_CONNECTION" && -z "$TMUX" && $- == *i* \
-      && "${PANAMA_SSH_TMUX:-on}" != "off" ]] && command -v tmux >/dev/null 2>&1; then
+if [[ -n "$SSH_CONNECTION" && -z "$TMUX" && $- == *i* &&
+  "${PANAMA_SSH_TMUX:-on}" != "off" ]] && command -v tmux >/dev/null 2>&1; then
   exec tmux new-session -A -s main
 fi