- Replace the 644/755 chmod sweep (which also undid its own chmod 700)
with go-w,a+rX so non-.sh executables keep +x.
- Install an oh-my-zsh .zshrc into /etc/skel after pacstrap. It is staged
as /root/.zshrc-skel because grml-zsh-config owns /etc/skel/.zshrc and
an airootfs copy would abort pacstrap.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
