chore: pin lock update workflow actions ci/update-lock-remotely

feat: isolate daily upgrades from the working checkout

fix: run flake update as regular user to preserve lock file ownership

feat: add rio config and refactor dotfiles to use flakeDirectory symlinks

feat: add homebrew taps for nikitabobko and steipete

fix: codexbar tap was needed

docs: rewrite README with bootstrap, daily use, and layout sections

refactor: reorganize modules into darwin/ and home/ directories

feat: support host-based darwin and home-manager configs