Explain surprising changes at review time

[ryanmagoon]

What changed

• Require inline reviewer context when a dependency, flag, workaround, suppression, or implementation choice looks surprising without additional context.
• Require user-level configuration changes to go through the chezmoi source, diff, dry-run, and apply workflow.
• Treat the dotfiles source and every related GitHub surface as public, and keep non-public business information and private origin context out of them.

Why

These rules keep rendered configuration reproducible across machines, reduce the amount of intent reviewers have to reconstruct, and make the public-repository boundary explicit.

Validation

• Reviewed the source and rendered diffs.
• Ran a scoped chezmoi dry run and apply.
• Confirmed the managed target matches the source.
• Scanned the complete PR diff and description for non-public identifiers and context.