provision: install kitty, neovim, lsd pinned; close audited tool gaps

[krishna-bala]

Follow-up to #3. An audit of every command the tracked configs and scripts invoke, compared against what provisioning actually installs, found a set of referenced-but-never-provisioned tools. They all worked by accident on machines where the tool predated this repo; a fresh provision left broken keybindings and silent feature loss.

Pinned upstream installs (new)

• kitty 0.47.4: the whole kitty/ config is symlinked, and sxhkd's terminal bindings, monitor-switch.sh, bin/clipimg, and bash_aliases all invoke it, but nothing installed it. Installed as the upstream binary bundle to ~/.local/kitty.app (22.04's apt kitty is 0.21, far too old for this config), with kitty/kitten symlinked into ~/.local/bin.
• neovim v0.12.3: EDITOR in bashrc, gitconfig's editor/difftool/mergetool, and lazygit's edit command all assume nvim. Same bundle treatment (~/.local/nvim.app); 22.04's apt neovim is 0.6.
• lsd v1.2.0: every ls alias points at it, but the install line was apt || cargo. Ubuntu 22.04 has no lsd package and cargo is never provisioned, so it failed exactly where it was needed. Now a pinned release binary like the other CLI tools.

kitty and neovim publish no checksum files (kitty ships GPG signatures), so their sha256s were computed from the reviewed downloads; every machine converges on byte-identical copies. Both install via a new install_release_bundle helper in provision-lib.sh, and all four binaries were exercised from the verified artifacts (--version smoke tests pass). The stale-duplicate check now covers lsd/kitty/nvim and suggests apt-get remove for dpkg-owned copies instead of deleting files out from under dpkg.

Desktop apt gaps

• x11-xkb-utils: swapescape.service execs /usr/bin/setxkbmap, which x11-xserver-utils does not provide.
• nitrogen: bspwmrc restores the wallpaper with it; the apt list installed feh instead, which nothing in the repo references. Swapped.
• network-manager-gnome, blueman: bspwmrc launches nm-applet and blueman-applet at every startup. They are pgrep-guarded, so their absence was silent tray-feature loss rather than an error.
• xdg-utils: dunstrc's browser is /usr/bin/xdg-open.
• dunstrc pointed its context menu at /usr/bin/dmenu, which was never provisioned. It now uses rofi's dmenu mode, since rofi is already part of the stack.

Deliberately not provisioned (documented in the apt-list comment and CLAUDE.md)

• protonvpn-app: comes from Proton's own repo; bspwmrc pgrep-guards it, so absence is harmless.
• exo-open: referenced only by the vendored polybar shades theme's gmail/google/twitter modules, which no profile enables.

Test plan

• All four new installs exercised end-to-end from the verified artifacts into a scratch $HOME: kitty 0.47.4, kitten 0.47.4, nvim 0.12.3, lsd 1.2.0 all run.
• shellcheck -S warning clean on all touched scripts; CI runs the full suite.
• Not runnable in this sandbox: an actual apt install of the new desktop packages, or a real graphical login. Worth a ./provision.sh run on a real machine; note it will flag any existing apt-installed kitty/lsd as shadowed duplicates with the removal command.

🤖 Generated with Claude Code

https://claude.ai/code/session_01SnU9EQrAZfjjhTTTt1PFAr

---

Generated by Claude Code