fix(skel): Keep script exec bits and ship a .zshrc for oh-my-zsh

- Replace the 644/755 chmod sweep (which also undid its own chmod 700)
  with go-w,a+rX so non-.sh executables keep +x.
- Install an oh-my-zsh .zshrc into /etc/skel after pacstrap. It is staged
  as /root/.zshrc-skel because grml-zsh-config owns /etc/skel/.zshrc and
  an airootfs copy would abort pacstrap.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

airootfs/root/.zshrc-skel

@@ -0,0 +1,30 @@
+# ~/.zshrc - installed into /etc/skel by customize_airootfs.sh (it replaces
+# grml-zsh-config's skel copy; grml's global /etc/zsh/zshrc still loads first).
+
+export ZSH="$HOME/.oh-my-zsh"
+ZSH_THEME=""                       # starship draws the prompt
+zstyle ':omz:update' mode reminder # never auto-pull on startup
+
+# Plugins are pre-cloned into $ZSH/custom/plugins at ISO build time.
+# zsh-syntax-highlighting must load before zsh-history-substring-search.
+# zsh-autocomplete is cloned too but left off: it fights grml's compinit
+# and zsh-autosuggestions - add it here only if you drop those.
+plugins=(
+  git
+  fzf-zsh-plugin
+  zsh-eza
+  zsh-autosuggestions
+  zsh-syntax-highlighting
+  zsh-history-substring-search
+)
+
+source "$ZSH/oh-my-zsh.sh"
+
+bindkey '^[[A' history-substring-search-up
+bindkey '^[[B' history-substring-search-down
+
+[[ -f ~/.fzf.zsh ]] && source ~/.fzf.zsh
+
+if command -v starship >/dev/null 2>&1 && [[ "$TERM" != "linux" ]]; then
+  eval "$(starship init zsh)"
+fi