Coexist with a desktop that already manages its tools (Omarchy)

On an Omarchy laptop bootstrap left two of almost everything: VS Code from
both pacman and the tarball (two menu entries, one shared ~/.config/Code
profile), and kubectl/helm/k9s/kubectx/yq/jq/node/ansible in ~/.local/bin
behind mise and pacman copies that always won on PATH. The zsh helpers
(op*, grmb, secrets.env) also never reached the bash login shell.

- lib/fetch.sh: add `shadowed`, true when another copy of a tool comes
  earlier on PATH than ~/.local/bin. Always false where zshrc puts
  ~/.local/bin first, so VM installs are unchanged.
- bin/, node/, ansible/: skip tools that are shadowed.
- vscode/: defer to any system `code`, and remove a tarball copy this
  module installed earlier.
- bash/: new module; bash port of the zshrc helpers, sourced from
  ~/.bashrc via a marked block. No-ops without ~/.bashrc.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -29,6 +29,11 @@ Already have a clone? Just run it directly:
   (robbyrussell theme, git plugin), and sets zsh as the login shell. The
   managed rc sources `~/.zshrc.local` last for per-machine customizations
   (see below).
+- `bash/` — for hosts that keep bash as the login shell (Omarchy), copies a
+  bash port of the `zsh/zshrc` helpers (`opr`/`opc`/`opd`/`opl`/`ops`,
+  `grmb`, and `secrets.env` loading) to `~/.config/dotfiles/dotfiles.bash` and
+  adds one marked source line to `~/.bashrc`. Never owns `~/.bashrc`; no-ops
+  when there is none. No sudo.
 - `git/` — sets git `user.name`/`user.email` and configures
   `credential.helper store` (plaintext `~/.git-credentials`, 0600) for
   HTTPS auth.
@@ -48,6 +53,10 @@ Already have a clone? Just run it directly:
   redeploys with no reinstall. Idempotent: each tool records its version
   under `~/.local/bin/.versions` and is skipped when the pinned version
   is already present. `zsh/zshrc` puts `~/.local/bin` on `PATH`.
+  A tool is also skipped when another copy comes *earlier* on `PATH` than
+  `~/.local/bin` (e.g. mise or pacman on Omarchy, where `~/.local/bin` is last),
+  since a copy there would never run. `node/` and `ansible/` follow the same
+  rule. On boxes where zshrc puts `~/.local/bin` first, nothing changes.
 - `secrets/` — reads your 1Password vault once and writes every field to
   `~/.config/dotfiles/secrets.env` (0600), which the managed `~/.zshrc`
   sources, so opening a shell never calls `op`. One vault per user and one
@@ -86,6 +95,10 @@ Already have a clone? Just run it directly:
   Also sets `password-store: basic` in `~/.vscode/argv.json` so KDE's kwallet
   does not prompt for an unlock on every launch (see below). **No-ops on
   headless hosts** — it's a ~400MB GUI app — override with `DOTFILES_VSCODE`.
+  **Defers to a system VS Code** (any `code` on `PATH` outside `~/.local/bin`,
+  e.g. Arch's `visual-studio-code-bin`): it skips the install and removes a
+  tarball copy it put there earlier, since two builds would show two menu
+  entries and share one `~/.config/Code` profile.
 - `docker-rootless-cgroup/` — on systemd-less hosts (e.g. Kasm), hand-delegates
   cgroup v2 controllers to the rootless Docker daemon so per-container cgroups
   work (rootless Docker otherwise comes up with