Coexist with a desktop that already manages its tools (Omarchy)

On an Omarchy laptop bootstrap left two of almost everything: VS Code from
both pacman and the tarball (two menu entries, one shared ~/.config/Code
profile), and kubectl/helm/k9s/kubectx/yq/jq/node/ansible in ~/.local/bin
behind mise and pacman copies that always won on PATH. The zsh helpers
(op*, grmb, secrets.env) also never reached the bash login shell.

- lib/fetch.sh: add `shadowed`, true when another copy of a tool comes
  earlier on PATH than ~/.local/bin. Always false where zshrc puts
  ~/.local/bin first, so VM installs are unchanged.
- bin/, node/, ansible/: skip tools that are shadowed.
- vscode/: defer to any system `code`, and remove a tarball copy this
  module installed earlier.
- bash/: new module; bash port of the zshrc helpers, sourced from
  ~/.bashrc via a marked block. No-ops without ~/.bashrc.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lib/fetch.sh

@@ -55,6 +55,38 @@ have_version() {
     [ "$(cat "$VERSION_DIR/$1")" = "$2" ]
 }
 
+# shadowed <name> — true (printing the winner's path) when another <name> sits
+# EARLIER on PATH than $BIN_DIR, so a copy installed there would never run.
+#
+# WHY: on a desktop that already manages these tools (Omarchy: pacman for VS
+# Code and jq, mise for kubectl/helm/node/...), ~/.local/bin is at the END of
+# PATH. Installing there anyway left a second, older copy of every tool that
+# nothing ran but `type -a` and the version stamps still reported. On the VMs
+# this repo targets, zshrc puts ~/.local/bin FIRST, so nothing shadows it and
+# this is always false -- installs there behave exactly as before. If $BIN_DIR
+# is not on PATH at all (a fresh box, before zshrc), it is false too.
+#
+# A mise shim with no version configured is not a real provider (it errors when
+# run), so shims only count when `mise which` resolves them.
+shadowed() {
+  _sh_name="$1"
+  _sh_ifs="$IFS"; IFS=:
+  # shellcheck disable=SC2086 # split PATH on ':' deliberately
+  set -- $PATH
+  IFS="$_sh_ifs"
+  case ":$PATH:" in *":$BIN_DIR:"*) ;; *) return 1 ;; esac
+  for _sh_dir; do
+    [ "$_sh_dir" = "$BIN_DIR" ] && return 1
+    [ -n "$_sh_dir" ] && [ -x "$_sh_dir/$_sh_name" ] && [ ! -d "$_sh_dir/$_sh_name" ] || continue
+    case "$_sh_dir" in
+      */mise/shims) mise which "$_sh_name" >/dev/null 2>&1 || continue ;;
+    esac
+    printf '%s\n' "$_sh_dir/$_sh_name"
+    return 0
+  done
+  return 1
+}
+
 # mark_version <name> <version> — record the installed version.
 mark_version() {
   mkdir -p "$VERSION_DIR"