fix(package): opt-in /bin/zsh replacement + de-duplicate manifest

[ss-o]

Summary

ZSH-13 high-priority package-quality fixes for the Zi zsh package manifest.

• Safety: the recipe no longer replaces the system /bin/zsh by default. The system replacement path now requires explicit ZSH_INSTALL_SYSTEM=1; by default it only builds into $ZPFX.
• System install hardening: the opt-in path now refuses to overwrite an existing /bin/zsh.bkp and no longer forces success if sudo mv / sudo cp fails.
• De-duplication / drift: the 11 profiles each carried an identical ~600-char atclone that had already drifted. Added scripts/build-manifest.py as the single source of truth; all profiles now share one consistent build body.
• Typo: LDFLAGS /usr/libs → /usr/lib, /usr/local/libs → /usr/local/lib.
• Docs: README default-profile section now points at the generated manifest and no longer documents unconditional /bin/zsh replacement.

Verification

• python3 scripts/build-manifest.py regenerated package.json.
• python3 -m json.tool package.json >/dev/null
• Manifest assertion: 11 profiles, one shared build body after stripping version checkout prefix.
• Manifest assertion: no /usr/libs, /usr/local/libs, or sudo rm -f /bin/zsh remains.
• Manifest assertion: system install body uses explicit ${ZSH_INSTALL_SYSTEM:-} != 1 gate.
• Manifest assertion: system install body checks [[ ! -e /bin/zsh.bkp ]] before backup.
• Manifest assertion: opt-in system install no longer ends with ; ((1)); } && m {ok} forced success.
• GitHub Actions green after latest push: Analyze, CodeQL, Trunk Check, Trunk Code Quality.

Runtime note

I did not run a destructive ZSH_INSTALL_SYSTEM=1 zi pack for zsh host smoke because that path intentionally targets /bin/zsh. The opt-in behavior is verified statically here; a runtime system-install smoke should be done in a disposable VM/container.

[Copilot]

Pull request overview

This PR improves the Zi zsh package manifest by making system /bin/zsh replacement opt-in, fixing linker path typos, and centralizing the duplicated atclone build recipe generation into a single script to prevent drift across version profiles.

Changes:

• Added a Python generator (scripts/build-manifest.py) to de-duplicate and regenerate package.json from a single build template + version list.
• Updated all manifest profiles to use corrected LDFLAGS paths and to gate /bin/zsh replacement behind ZSH_INSTALL_SYSTEM.
• Documented the opt-in system installation behavior in docs/README.md.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
scripts/build-manifest.py	New generator script defining the single-source build recipe + profiles and writing package.json.
package.json	Regenerated manifest with corrected LDFLAGS paths and opt-in /bin/zsh replacement guard in atclone.
docs/README.md	Added a section describing the new opt-in system installation behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.