Keep .bashrc a bootstrap, and secrets out of the checkout for real

.bashrc is back to its one job: export the Panama paths and source
what it finds. The personal-env block moves into config/bash/shell —
first, because the tmux guard below it reads that file — and the
cargo source that was duplicated between the two files lives only in
shell now.

The real fix is behind that tidying: both Home Assistant helpers
defaulted to the IN-REPO config/bash/env, and the writer rebuilt it
with only its own three lines — which read as "my env vars vanished"
to the person who thought that file was hand-maintained. Both now
prefer ~/.config/panama/env, the migrated home outside the checkout,
with the repo path kept only as a read fallback for unmigrated
machines. The stale legacy copy on this machine is retired; the
working credentials were merged into the migrated file first, after
probing both sets against the live Home Assistant.

Claude-Session: https://claude.ai/code/session_01Ms2FbjQy31TVf3CEvQhGM8

config/dot/quickshell/scripts/panama-home-assistant

@@ -44,7 +44,12 @@ GNOME_EXTENSION = (
 )
 GNOME_SCHEMA_DIR = GNOME_EXTENSION / "schemas"
 GNOME_SCHEMA = "org.gnome.shell.extensions.hass-data"
-PANAMA_ENV = pathlib.Path(__file__).resolve().parents[3] / "bash/env"
+# The migrated personal env (outside the checkout) wins; the in-repo file is
+# only read on machines that have not migrated. See panama-home-assistant-config.
+LEGACY_ENV = pathlib.Path(__file__).resolve().parents[3] / "bash/env"
+_config_home = pathlib.Path(os.environ.get("XDG_CONFIG_HOME", str(pathlib.Path.home() / ".config")))
+_migrated_env = _config_home / "panama" / "env"
+PANAMA_ENV = _migrated_env if _migrated_env.exists() else LEGACY_ENV
 Runner = Callable[..., subprocess.CompletedProcess[str]]