fix(skel): Keep script exec bits and ship a .zshrc for oh-my-zsh

- Replace the 644/755 chmod sweep (which also undid its own chmod 700)
  with go-w,a+rX so non-.sh executables keep +x.
- Install an oh-my-zsh .zshrc into /etc/skel after pacstrap. It is staged
  as /root/.zshrc-skel because grml-zsh-config owns /etc/skel/.zshrc and
  an airootfs copy would abort pacstrap.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

airootfs/root/.zshrc-skel

@@ -0,0 +1,30 @@
+# ~/.zshrc - installed into /etc/skel by customize_airootfs.sh (it replaces
+# grml-zsh-config's skel copy; grml's global /etc/zsh/zshrc still loads first).
+
+export ZSH="$HOME/.oh-my-zsh"
+ZSH_THEME=""                       # starship draws the prompt
+zstyle ':omz:update' mode reminder # never auto-pull on startup
+
+# Plugins are pre-cloned into $ZSH/custom/plugins at ISO build time.
+# zsh-syntax-highlighting must load before zsh-history-substring-search.
+# zsh-autocomplete is cloned too but left off: it fights grml's compinit
+# and zsh-autosuggestions - add it here only if you drop those.
+plugins=(
+  git
+  fzf-zsh-plugin
+  zsh-eza
+  zsh-autosuggestions
+  zsh-syntax-highlighting
+  zsh-history-substring-search
+)
+
+source "$ZSH/oh-my-zsh.sh"
+
+bindkey '^[[A' history-substring-search-up
+bindkey '^[[B' history-substring-search-down
+
+[[ -f ~/.fzf.zsh ]] && source ~/.fzf.zsh
+
+if command -v starship >/dev/null 2>&1 && [[ "$TERM" != "linux" ]]; then
+  eval "$(starship init zsh)"
+fi

airootfs/root/customize_airootfs.sh

@@ -72,6 +72,14 @@ for plugin in "${!OMZ_PLUGINS[@]}"; do
   fi
 done
 
+# grml-zsh-config owns /etc/skel/.zshrc, so shipping ours in
+# airootfs/etc/skel would make pacstrap abort ("exists in filesystem").
+# Stage it under /root and overwrite the package's copy here, after pacstrap.
+if [[ -f /root/.zshrc-skel ]]; then
+  install -m 0644 /root/.zshrc-skel "${SKEL}/.zshrc"
+  rm -f /root/.zshrc-skel
+fi
+
 # ── LazyVim (lazy.nvim bootstraps on first launch, but pre-clone the plugin) ─
 NVIM_DATA="${SKEL}/.local/share/nvim"
 mkdir -p "${NVIM_DATA}"
@@ -354,18 +362,18 @@ else
   echo "[customize] uv not found - skipping python/wheel pre-warm."
 fi
 
-# ── Fish: ensure default shell is set for the live user ──────────────────────
-# The live user (usually 'archlinux' or 'root') gets fish as default shell
+# ── Fish: default shell for the live root user ───────────────────────────────
+# (alvin-install creates the installed user with fish as well.)
 if command -v fish &>/dev/null; then
-  echo "[customize] Setting fish as default shell for skel..."
+  echo "[customize] Setting fish as root's shell on the live medium..."
   chsh -s /usr/bin/fish root 2>/dev/null || true
 fi
 
 # ── Ensure skel directories have correct permissions ─────────────────────────
-chmod 700 "${SKEL}/.config" 2>/dev/null || true
-find "${SKEL}/.config" -type f -exec chmod 644 {} \; 2>/dev/null || true
-find "${SKEL}/.config" -type d -exec chmod 755 {} \; 2>/dev/null || true
-find "${SKEL}/.config" -name '*.sh' -exec chmod 755 {} \; 2>/dev/null || true
-find "${SKEL}/.local" -type d -exec chmod 755 {} \; 2>/dev/null || true
+# Only take away group/other write and make everything readable: forcing
+# files to 644 stripped +x from executables that are not *.sh (python/fish
+# helpers in the cloned quickshell configs).
+chmod -R go-w,a+rX "${SKEL}/.config" "${SKEL}/.local" 2>/dev/null || true
+find "${SKEL}/.config" -name '*.sh' -exec chmod 755 {} + 2>/dev/null || true
 
 echo "[customize] Dotfile pre-installation complete."