Easier new and existing Mac setup

[helderberto]

Fewer manual steps on a new Mac, plus a safe path for an existing one.

Changes

• git: insteadOf → pushInsteadOf. https clones (asdf plugins, lazy.nvim, tpm) work before the SSH key is on GitHub; pushes still go over SSH. Drops README step "install runtimes".
• tmux: new run_onchange_after_tmux.sh.tmpl clones tpm and runs install_plugins, keyed on dot_tmux.conf hash. tpm clone moved out of the before packages script, where ~/.tmux.conf doesn't exist yet on first run. Drops README step prefix + I.
• Dock: pin Claude desktop (cask already on main via 213b072). Order matches the current Mac so the run_once rerun is a no-op.
• README: Existing Mac section (init → diff → apply); chezmoi update alone (applies by default).
• Drift: README pre-migration check (chezmoi status, brew bundle cleanup); --post-apply asserts brew bundle check and every tmux @plugin installed.

Review notes

• pushInsteadOf trade-off: cloning a private repo via an https URL now needs credentials (gh auth login / gh auth setup-git). SSH URLs unaffected.
• Before chezmoi update on a Mac with a hand-installed Claude.app: brew install --cask --adopt claude, else brew bundle fails on the existing app.

Verification

• ./test-chezmoi.sh passes; each new test was red before its fix.
• With GIT_SSH_COMMAND=false: https ls-remote succeeds with new gitconfig, fails with old; push URL resolves to git@github.com:.
• Rendered tmux script run with bare PATH=/usr/bin:/bin: installed tmux-sensible.
• CI shellcheck command passes locally.