fix(config): clean up config symlinks

[PaleBluDot]

Summary

This PR consolidates several improvements across the dotfiles setup, plus security hardening.

Symlink system overhaul

Replaced all per-tool symlinks.txt files with a single unified config/symlinks.yml. Gives a central, structured view of every symlink mapping across tools and OSes, enabling the installer to use yq for parsing instead of scattered plaintext files.

New hexclock.py script

Adds a color-based clock to bin/ that displays the current time as a hex color code, paired with the welcome screen.

Welcome message cleanup

Simplified bin/welcome.sh to reduce noise and improve readability at shell startup.

Claude Code instructions

Added CLAUDE.md with repo-specific guidance: install commands, commit conventions, architecture overview, and how to add new tool configs.

Settings sync

Updated VSCode settings.json and commitizen.config.js to match current dotfiles conventions (wordwrap, scopes, etc.).

Secret safety / npm auth hardening

Removed hardcoded npm auth token from .npmrc. Token is now referenced via ${NPM_TOKEN} environment variable so the file is safe to commit to a public repo. GitHub Actions already receives NPM_TOKEN via repo secrets.

Config env variable standardization

Renamed internal env var from DOT_DIR → DOTFILES for clarity and consistency across shell configs.

New CI helper functions

Added shell functions to set GitHub repo secrets and environment variables programmatically.

Removed unused configs

Removed Spotify and WakaTime config stubs that weren't ready to be committed.

Commitizen scope expansion

Added more scopes to commitizen.config.js to cover CI and new config areas.

Codacy static analysis fixes

Resolved violations in bin/hexclock.py: restricted Flask server to 127.0.0.1 (was binding to all interfaces) and suppressed false-positive template string warning with # noqa annotation.

Verified commit signing

Updated user.signingkey in .gitconfig to match the SSH signing key registered on GitHub (1Password), so commits show as verified.

---

Files Changed

Area	Change
config/symlinks.yml	New unified symlink manifest (replaces all symlinks.txt files)
config/npm/.npmrc	Replaced hardcoded npm token with ${NPM_TOKEN} env var
bin/hexclock.py	New hex color clock script; Codacy violations resolved
bin/welcome.sh	Cleaned up shell welcome message
CLAUDE.md	New Claude Code guidance doc
config/starship/	Added starship prompt config files
config/fastfetch/	Added fastfetch config
config/massCode/	Added massCode snippet config
config/vscode/settings.json	Synced settings
commitizen.config.js	Updated scopes and formatting
config/zsh/.zshrc, .zshenv, .aliases	Shell config improvements
config/git/.gitconfig	Updated SSH signing key to match GitHub; git config updates
config/os-only/macos/Brewfile	Updated Homebrew packages

Test Plan

• Run ./install.sh install -d on a clean machine and verify all symlinks resolve correctly from symlinks.yml
• Confirm hexclock.py runs without error and outputs a valid hex color
• Verify welcome message renders cleanly at shell startup
• Confirm npm installs work with NPM_TOKEN set as an env var (not hardcoded)
• Check VSCode picks up updated settings.json via symlink
• Confirm Codacy passes clean on bin/hexclock.py
• Verify new commits show as "Verified" on GitHub

🤖 Generated with Claude Code

[PaleBluDot]

🎉 This PR is included in version 1.5.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀