chore: address dotfiles audit findings

.chezmoiignore

@@ -68,7 +68,7 @@ Documents/
 .wslconfig
 {{- end }}
 
-# Not used on Windows (runtimes managed via fnm + standalone installs)
+# Keep runtime config machine-local on Windows (Node via fnm; other runtimes as needed)
 # run scripts are bash-only, PGP-SSH setup is handled manually
 {{- if eq .chezmoi.os "windows" }}
 .config/mise/

.github/workflows/dotfiles-tests.yml

@@ -0,0 +1,54 @@
+name: Dotfiles tests
+
+on:
+  push:
+    branches:
+      - main
+      - "kevintcoughlin/**"
+  pull_request:
+
+jobs:
+  test-linux:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install test dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -r tests/requirements-dev.txt
+          sudo apt-get update
+          sudo apt-get install -y bats
+
+      - name: Run Python tests
+        run: pytest tests -v
+
+      - name: Run BATS tests
+        run: bats tests/*.bats
+
+  cross-platform-smoke:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Validate repository smoke checks
+        shell: pwsh
+        run: |
+          $tracked = git ls-files
+          $cacheMatches = $tracked | Select-String -Pattern '(^|/)tests/__pycache__/|\.pyc$'
+          if ($cacheMatches) {
+            Write-Error "Tracked cache artifacts detected:`n$($cacheMatches -join "`n")"
+            exit 1
+          }

CLAUDE.md

@@ -21,7 +21,7 @@ Single tool replaces fnm/pyenv/SDKMAN:
 
 ```bash
 mise list                    # show installed
-mise use node@22             # project-local
+mise use node@24             # project-local
 mise use --global python@3   # global default
 mise current                 # show active versions
 ```
@@ -145,14 +145,14 @@ Notes:
 
 | Tool | Version | Manager |
 |------|---------|---------|
-| Node.js | 24.x LTS | mise |
-| Python | 3.13 | mise (3.14 also via winget on rogpop16redux) |
-| Java | 21 (Temurin) | mise |
+| Node.js | 24.x LTS | fnm |
+| Python | 3.13 | winget / machine-local |
+| Java | 21 (Temurin) | winget / machine-local |
 | Rust | 1.95.x (stable) | rustup |
-| Go | 1.26.x | mise |
-| Bun | 1.3.x | mise |
-| Deno | 2.7.x | mise |
-| Zig | 0.16.x | mise |
+| Go | 1.26.x | mise (optional, machine-local) |
+| Bun | 1.3.x | mise (optional, machine-local) |
+| Deno | 2.7.x | mise (optional, machine-local) |
+| Zig | 0.16.x | mise (optional, machine-local) |
 
 ### Key Tools
 
@@ -162,13 +162,15 @@ Docker Desktop, uv, Ollama (rogpop16redux only — CUDA on RTX 4090)
 
 ```bash
 winget upgrade --all            # Windows packages
-mise upgrade                    # bun, deno, go, node, python, java, zig
+fnm install --lts               # Node.js LTS
+fnm default lts-latest          # Set default Node.js LTS
+mise upgrade                    # optional: bun, deno, go, zig
 mise self-update                # mise itself
 rustup update stable            # Rust toolchain
 gh extension upgrade --all      # gh extensions
 npm update -g                   # global npm packages
 Update-Module -Force            # PowerShell modules
-pip install --upgrade <pkg>     # Python packages
+pip install --upgrade <pkg>     # Python packages (where pip-managed)
 ```
 
 ---

README.md

@@ -45,13 +45,15 @@ chezmoi init --apply KevinTCoughlin
 
 ### Runtimes (mise)
 
+Applies to macOS/Linux. Windows keeps Node.js on `fnm` and may use machine-local runtime installs.
+
 Single tool replaces fnm/pyenv/SDKMAN:
 
 Node, Python, Java (Temurin), Go, Ruby, Rust, Bun, Deno, Zig, SwiftFormat, SwiftLint
 
 ```bash
 mise list             # installed versions
-mise use node@25      # project-local
+mise use node@24      # project-local
 mise use --global go  # global default
 mise upgrade --all    # update all
 ```

dot_local/bin/executable_bootstrap

@@ -3,7 +3,7 @@
 # Run on a fresh Mac:
 #   curl --fail --show-error --location --proto '=https' --tlsv1.2 \
 #     -o /tmp/bootstrap.sh \
-#     https://raw.githubusercontent.com/KevinTCoughlin/dotfiles/main/bootstrap.sh
+#     https://raw.githubusercontent.com/KevinTCoughlin/dotfiles/main/dot_local/bin/executable_bootstrap
 #   bash /tmp/bootstrap.sh
 
 set -e