fix(skel): Keep script exec bits and ship a .zshrc for oh-my-zsh

- Replace the 644/755 chmod sweep (which also undid its own chmod 700)
  with go-w,a+rX so non-.sh executables keep +x.
- Install an oh-my-zsh .zshrc into /etc/skel after pacstrap. It is staged
  as /root/.zshrc-skel because grml-zsh-config owns /etc/skel/.zshrc and
  an airootfs copy would abort pacstrap.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

airootfs/root/customize_airootfs.sh

@@ -72,6 +72,14 @@ for plugin in "${!OMZ_PLUGINS[@]}"; do
   fi
 done
 
+# grml-zsh-config owns /etc/skel/.zshrc, so shipping ours in
+# airootfs/etc/skel would make pacstrap abort ("exists in filesystem").
+# Stage it under /root and overwrite the package's copy here, after pacstrap.
+if [[ -f /root/.zshrc-skel ]]; then
+  install -m 0644 /root/.zshrc-skel "${SKEL}/.zshrc"
+  rm -f /root/.zshrc-skel
+fi
+
 # ── LazyVim (lazy.nvim bootstraps on first launch, but pre-clone the plugin) ─
 NVIM_DATA="${SKEL}/.local/share/nvim"
 mkdir -p "${NVIM_DATA}"
@@ -354,18 +362,18 @@ else
   echo "[customize] uv not found - skipping python/wheel pre-warm."
 fi
 
-# ── Fish: ensure default shell is set for the live user ──────────────────────
-# The live user (usually 'archlinux' or 'root') gets fish as default shell
+# ── Fish: default shell for the live root user ───────────────────────────────
+# (alvin-install creates the installed user with fish as well.)
 if command -v fish &>/dev/null; then
-  echo "[customize] Setting fish as default shell for skel..."
+  echo "[customize] Setting fish as root's shell on the live medium..."
   chsh -s /usr/bin/fish root 2>/dev/null || true
 fi
 
 # ── Ensure skel directories have correct permissions ─────────────────────────
-chmod 700 "${SKEL}/.config" 2>/dev/null || true
-find "${SKEL}/.config" -type f -exec chmod 644 {} \; 2>/dev/null || true
-find "${SKEL}/.config" -type d -exec chmod 755 {} \; 2>/dev/null || true
-find "${SKEL}/.config" -name '*.sh' -exec chmod 755 {} \; 2>/dev/null || true
-find "${SKEL}/.local" -type d -exec chmod 755 {} \; 2>/dev/null || true
+# Only take away group/other write and make everything readable: forcing
+# files to 644 stripped +x from executables that are not *.sh (python/fish
+# helpers in the cloned quickshell configs).
+chmod -R go-w,a+rX "${SKEL}/.config" "${SKEL}/.local" 2>/dev/null || true
+find "${SKEL}/.config" -name '*.sh' -exec chmod 755 {} + 2>/dev/null || true
 
 echo "[customize] Dotfile pre-installation complete."