Coexist with a desktop that already manages its tools (Omarchy)

On an Omarchy laptop bootstrap left two of almost everything: VS Code from
both pacman and the tarball (two menu entries, one shared ~/.config/Code
profile), and kubectl/helm/k9s/kubectx/yq/jq/node/ansible in ~/.local/bin
behind mise and pacman copies that always won on PATH. The zsh helpers
(op*, grmb, secrets.env) also never reached the bash login shell.

- lib/fetch.sh: add `shadowed`, true when another copy of a tool comes
  earlier on PATH than ~/.local/bin. Always false where zshrc puts
  ~/.local/bin first, so VM installs are unchanged.
- bin/, node/, ansible/: skip tools that are shadowed.
- vscode/: defer to any system `code`, and remove a tarball copy this
  module installed earlier.
- bash/: new module; bash port of the zshrc helpers, sourced from
  ~/.bashrc via a marked block. No-ops without ~/.bashrc.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

vscode/install.sh

@@ -69,6 +69,37 @@ case "${DOTFILES_VSCODE:-auto}" in
      fi ;;
 esac
 
+# --- defer to a system-wide VS Code -------------------------------------------
+# WHY: a distro package (Arch's visual-studio-code-bin on Omarchy, Microsoft's
+# rpm/deb elsewhere) and this tarball both add a "Visual Studio Code" menu entry
+# and both open the same ~/.config/Code profile. Two builds on one profile is
+# the real hazard: the older one opens state the newer one already migrated,
+# and extensions break in ways that look like extension bugs. The system copy
+# also gets updates this pinned one does not, so it wins.
+#
+# PATH order is irrelevant here (unlike `shadowed` in bin/): the menu entries
+# collide wherever the binaries sit. Anything we installed earlier is removed --
+# only ours, recognised by the .desktop Exec pointing into $PREFIX.
+_sys_code=""
+_sh_ifs="$IFS"; IFS=:
+for _d in $PATH; do
+  [ "$_d" != "$BIN_DIR" ] && [ -x "$_d/code" ] && { _sys_code="$_d/code"; break; }
+done
+IFS="$_sh_ifs"
+if [ -n "$_sys_code" ]; then
+  say "vscode: system VS Code at $_sys_code; skipping the tarball install."
+  if grep -qs "^Exec=$PREFIX/" "$DESKTOP_DIR/code.desktop"; then
+    rm -f "$DESKTOP_DIR/code.desktop"
+    [ "$(readlink "$BIN_DIR/code" 2>/dev/null)" = "$PREFIX/bin/code" ] && rm -f "$BIN_DIR/code"
+    rm -f "$VERSION_DIR/code"
+    rm -rf "$PREFIX"
+    command -v update-desktop-database >/dev/null 2>&1 &&
+      update-desktop-database "$DESKTOP_DIR" 2>/dev/null || true
+    say "vscode: removed the earlier tarball copy ($PREFIX, its menu entry and $BIN_DIR/code)."
+  fi
+  exit 0
+fi
+
 # Upstream keys its download URLs on x64/arm64 rather than amd64/arm64.
 case "$(fetch_arch)" in
   x86_64)  VSCODE_ARCH=x64 ;;
@@ -202,15 +233,4 @@ else
   fi
 fi
 
-# A system-wide VS Code (from Microsoft's rpm/deb repo) shadows this one in the
-# menu and shows a duplicate entry. Flag it rather than touching it -- removing
-# it needs the root this module deliberately avoids.
-if [ -e /usr/share/applications/com.microsoft.VSCode.desktop ]; then
-  say ""
-  say "vscode: NOTE: a system-wide VS Code package is also installed."
-  say "  You will see two menu entries until it is removed:"
-  say "    sudo dnf remove code   # or: sudo apt remove code"
-  say ""
-fi
-
 say "vscode: ready."