feat: define the windows-iso-maker ↔ chezmoi boundary and migrate per-user Windows config

[DevSecNinja]

Context

windows-iso-maker builds/debloats the Windows image and applies machine-wide, pre-login,
admin changes (HKLM policy, removed components, feature enablement, WSL, OneDrive KFM policy,
activation checks). Anything that is per-user, app-level, or iterated often is a better fit for
these dotfiles (chezmoi), where it can template per-machine and roam.

Rule of thumb

• windows-iso-maker → HKLM / pre-login / requires admin / must exist before first login
  (debloat, removed apps, policies, feature enablement, image seeds).
• chezmoi (this repo) → HKCU / app config / personal prefs / changes frequently.
• Gray-area per-user prefs (dark mode, show file extensions, Excel separator) can live in
  either. Decision: chezmoi is the source of truth; windows-iso-maker may seed a sane default
  into the image's Default hive, but chezmoi wins on a configured machine.

Items to add/migrate to chezmoi

• Windows Terminal settings.json — manage via chezmoi template (parse + modify, don't
  wholesale-replace, so previous/future changes aren't lost):
  • Default profile = PowerShell (Core), or Debian (WSL) if installed.
  • Keep the Shift+Enter → newline keybinding (sendInput "\u001b\r") for GitHub Copilot.
  • Preserve the other existing keybindings (Ctrl+Backspace, duplicate pane, copy/paste).
• Night Light on a sunset→sunrise schedule (requires Location services on). Fragile
  timestamped blob under ...\CloudStore\...\DefaultAccount\...\windows.data.bluelightreduction.*;
  per-user, online-only — belongs here, not in the image.
• Display scale 125% — per-monitor/EDID-specific, not portable across machines; set per
  device (document, don't hard-bake).
• Color profile: sRGB on the active display — per-display ICC association; set on the
  machine (candidate for a small chezmoi run-script using Windows Color System).
• Dark mode — mirror of reg-dark-mode-apps/system (chezmoi = source of truth).
• Show file extensions — mirror of reg-show-file-extensions.
• Excel comma CSV separator (US number format: sDecimal='.', sThousand=',',
  sList=',') — mirror of the reg-number-format-* entries.
• Personal app installs (1Password, etc.) — winget/scoop manifest managed by chezmoi.

Notes / open questions

• For the gray-area items already baked into windows-iso-maker's opinionated profile
  (dark mode, HideFileExt, Excel separator), decide whether chezmoi should re-assert them on every
  apply or only set them if unset.
• Windows Terminal: prefer a JSON-merge (jq/PowerShell) in a chezmoi run_onchange script over a
  managed static file, to avoid clobbering Terminal's own writes.

Related

• Repo: DevSecNinja/windows-iso-maker (machine/image side).
• Deferred in windows-iso-maker (stay there, not chezmoi): OneDrive KFM policy incl. Pictures,
  activation check, Quick Machine Recovery enablement.