refactor: consolidate install/update scripts, expand CI matrix

- Merge lib/check.sh into lib/utils.sh; remove now-redundant check.sh
- Move install-cmake.sh, install-git.sh to scripts/ subdirectory
- Drop versions.env; versions are fetched at runtime from GitHub releases
- base.sh: install fzf/zoxide/delta/eza via private helpers instead of apt
  so they pick up latest releases and work on Ubuntu 20.04+
- CI: add Ubuntu 20.04 to test matrix (previously blocked by apt zoxide)
- CI: simplify workflow — drop inline verify block, delegate to test.sh
- ci: apply curl auth header for all profiles (not workstation-only)
- zsh: add DISABLE_MAGIC_FUNCTIONS, restore explicit fzf.zsh source,
  fix TERM guard to not clobber existing $TERM
- tmux: fix config indentation and plugin handling
- Add test-local.sh (local CI matrix runner) and clean-test-images.sh
- Add .dockerignore to speed up Docker build context
- Reformat git/.gitconfig to use consistent indentation

Author: NLPSoftwareDemo

.dockerignore

@@ -0,0 +1,15 @@
+# Git history — not needed inside the image
+.git
+
+# Local dev artifacts — must not pollute the build context or break layer caching
+.test-results
+test-logs
+
+# Claude Code session data
+.claude
+
+# Downloaded install artifacts (gitignored; stale files from old runs)
+parallel-*/
+*.tar.bz2
+*.tar.bz2.sig
+*.deb

.github/workflows/install.yml

@@ -21,10 +21,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # Ubuntu 20.04 (focal) omitted: 'zoxide' is not in focal's apt repos.
-        # The install scripts call `apt install zoxide` unconditionally, which
-        # aborts the install on focal. Fix the scripts first, then add 20.04.
-        ubuntu: ["22.04", "24.04"]
+        ubuntu: ["20.04", "22.04", "24.04"]
         profile: [docker, minimal, workstation]
 
     steps:
@@ -47,8 +44,7 @@ jobs:
           cp -r . /home/testuser/dotfiles
           chown -R testuser:testuser /home/testuser/dotfiles
 
-      - name: Configure curl auth (workstation — avoids GitHub API rate limit in _install_cheat)
-        if: matrix.profile == 'workstation'
+      - name: Configure curl auth (avoids GitHub API rate limit)
         run: |
           printf 'header = "Authorization: Bearer %s"\n' "${{ secrets.GITHUB_TOKEN }}" \
             > /home/testuser/.curlrc
@@ -61,204 +57,11 @@ jobs:
       - name: Idempotency — re-run install.sh
         run: su -s /bin/bash -c 'HOME=/home/testuser; export HOME; cd ~/dotfiles && bash install.sh ${{ matrix.profile }}' testuser
 
-      - name: Verify symlinks
-        run: |
-          cat > /tmp/verify_links.sh << 'EOF'
-          #!/bin/bash
-          set -euo pipefail
-          fail=0
-          check_link() {
-            if [ -L "$1" ]; then
-              echo "  OK  $1 -> $(readlink "$1")"
-            else
-              echo "  FAIL  $1 is not a symlink" >&2
-              fail=1
-            fi
-          }
-          check_link ~/.zshrc
-          check_link ~/.tmux.conf
-          check_link ~/.tmux.conf.local
-          check_link ~/.gitconfig
-          check_link ~/.gitattributes
-          exit $fail
-          EOF
-          chmod +x /tmp/verify_links.sh
-          su -s /bin/bash -c /tmp/verify_links.sh testuser
-
-      - name: Verify tools on PATH
-        run: |
-          cat > /tmp/verify_tools.sh << 'EOF'
-          #!/bin/bash
-          set -euo pipefail
-          export PATH="$HOME/.local/bin:$PATH"
-          fail=0
-          check_cmd() {
-            if command -v "$1" &>/dev/null; then
-              echo "  OK  $1 ($(command -v "$1"))"
-            else
-              echo "  FAIL  $1 not found" >&2
-              fail=1
-            fi
-          }
-          check_cmd zsh
-          check_cmd tmux
-          check_cmd git
-          check_cmd fzf
-          check_cmd rg
-          check_cmd zoxide
-          exit $fail
-          EOF
-          chmod +x /tmp/verify_tools.sh
-          su -s /bin/bash -c /tmp/verify_tools.sh testuser
-
-      - name: Verify minimal-only tools
-        if: matrix.profile == 'minimal'
-        run: |
-          cat > /tmp/verify_minimal.sh << 'EOF'
-          #!/bin/bash
-          set -euo pipefail
-          fail=0
-          check_cmd() {
-            if command -v "$1" &>/dev/null; then
-              echo "  OK  $1 ($(command -v "$1"))"
-            else
-              echo "  FAIL  $1 not found" >&2
-              fail=1
-            fi
-          }
-          check_cmd ranger
-          check_cmd tig
-          check_cmd parallel
-          exit $fail
-          EOF
-          chmod +x /tmp/verify_minimal.sh
-          su -s /bin/bash -c /tmp/verify_minimal.sh testuser
-
-      - name: Verify workstation-only tools and configs
-        if: matrix.profile == 'workstation'
-        run: |
-          cat > /tmp/verify_workstation.sh << 'EOF'
-          #!/bin/bash
-          set -euo pipefail
-          export PATH="$HOME/.local/bin:$PATH"
-          fail=0
-          check_cmd() {
-            if command -v "$1" &>/dev/null; then
-              echo "  OK  $1 ($(command -v "$1"))"
-            else
-              echo "  FAIL  $1 not found" >&2
-              fail=1
-            fi
-          }
-          check_file() {
-            if [ -f "$1" ]; then
-              echo "  OK  $1"
-            else
-              echo "  FAIL  $1 not found" >&2
-              fail=1
-            fi
-          }
-          check_link() {
-            if [ -L "$1" ]; then
-              echo "  OK  $1 -> $(readlink "$1")"
-            else
-              echo "  FAIL  $1 is not a symlink" >&2
-              fail=1
-            fi
-          }
-          check_cmd nvim
-          check_cmd delta
-          check_cmd uv
-          check_cmd cheat
-          check_link ~/.config/nvim
-          check_link ~/.config/ripgrep/rc
-          check_link ~/.config/ranger/rc.conf
-          check_link ~/.config/ranger/rifle.conf
-          check_link ~/.config/ranger/scope.sh
-          exit $fail
-          EOF
-          chmod +x /tmp/verify_workstation.sh
-          su -s /bin/bash -c /tmp/verify_workstation.sh testuser
-
-      - name: Verify oh-my-zsh and plugins
-        run: |
-          cat > /tmp/verify_zsh.sh << 'EOF'
-          #!/bin/bash
-          set -euo pipefail
-          fail=0
-          check_dir() {
-            if [ -d "$1" ]; then
-              echo "  OK  $1"
-            else
-              echo "  FAIL  $1 not found" >&2
-              fail=1
-            fi
-          }
-          if [ -d ~/.oh-my-zsh ]; then
-            echo "  OK  ~/.oh-my-zsh"
-          else
-            echo "  FAIL  ~/.oh-my-zsh not found" >&2
-            fail=1
-          fi
-          custom="${ZSH_CUSTOM:-$HOME/.oh-my-zsh/custom}"
-          check_dir "$custom/plugins/zsh-autosuggestions"
-          check_dir "$custom/plugins/fast-syntax-highlighting"
-          check_dir "$custom/plugins/fzf-tab"
-          check_dir "$custom/themes/powerlevel10k"
-          exit $fail
-          EOF
-          chmod +x /tmp/verify_zsh.sh
-          su -s /bin/bash -c /tmp/verify_zsh.sh testuser
-
-      - name: Smoke-test configs
-        run: |
-          cat > /tmp/smoke_test.sh << 'EOF'
-          #!/bin/bash
-          set -euo pipefail
-          export PATH="$HOME/.local/bin:$PATH"
-          export TERM=xterm-256color   # tmux client needs TERM even in detached mode
-
-          # zsh: syntax check only — p10k needs a real terminal so we don't source
-          zsh -n ~/.zshrc && echo "  OK  ~/.zshrc syntax valid"
-
-          # tmux: load config in detached session (no tty required)
-          tmux -f ~/.tmux.conf new-session -d -s ci_smoke
-          tmux kill-session -t ci_smoke
-          echo "  OK  tmux config loads"
-
-          # git: verify our specific config was applied (not just git defaults)
-          git config --global diff.zip.textconv | grep -q 'unzip' && echo "  OK  git config: dotfiles settings applied"
-
-          # tool versions confirm binaries are functional
-          zsh --version
-          tmux -V
-          rg --version | head -1
-          fzf --version
-          zoxide --version
-          EOF
-          chmod +x /tmp/smoke_test.sh
-          su -s /bin/bash -c /tmp/smoke_test.sh testuser
+      - name: Run test suite
+        run: su -s /bin/bash -c 'HOME=/home/testuser; export HOME; export TERM=xterm-256color; cd ~/dotfiles && bash test.sh ${{ matrix.profile }}' testuser
 
       - name: Run update.sh
         run: su -s /bin/bash -c 'HOME=/home/testuser; export HOME; cd ~/dotfiles && bash update.sh' testuser
 
-      - name: Verify tool versions after update
-        run: |
-          cat > /tmp/verify_versions.sh << 'EOF'
-          #!/bin/bash
-          set -euo pipefail
-          export PATH="$HOME/.local/bin:$PATH"
-          echo "── Tool versions after update ──"
-          fzf --version
-          rg --version | head -1
-          fd --version 2>/dev/null || fdfind --version | head -1
-          shellcheck --version | grep version:
-          zoxide --version
-          tmux -V
-          zsh --version
-          echo "── fzf shell integration ──"
-          test -f /usr/share/doc/fzf/examples/key-bindings.zsh && echo "  OK  key-bindings.zsh present"
-          test -f /usr/share/doc/fzf/examples/completion.zsh   && echo "  OK  completion.zsh present"
-          EOF
-          chmod +x /tmp/verify_versions.sh
-          su -s /bin/bash -c /tmp/verify_versions.sh testuser
+      - name: Re-run test suite after update
+        run: su -s /bin/bash -c 'HOME=/home/testuser; export HOME; export TERM=xterm-256color; cd ~/dotfiles && bash test.sh ${{ matrix.profile }}' testuser

.gitignore

@@ -3,3 +3,6 @@ parallel-*/
 *.tar.bz2
 *.tar.bz2.sig
 *.deb
+
+# Local test run artifacts
+.test-results/

Dockerfile

@@ -1,15 +1,16 @@
 # Test dotfiles install in a clean Ubuntu environment.
 #
 # Build & run (installs during build, then drops to shell):
-#   docker build -t dotfiles-test .
-#   docker run --rm -it dotfiles-test
+#   docker build -t dotfiles-test:24.04-docker .
+#   docker run --rm -it dotfiles-test:24.04-docker
 #
 # Choose Ubuntu version or install profile:
-#   docker build --build-arg UBUNTU=22.04 --build-arg PROFILE=minimal -t dotfiles-test .
-#   docker build --build-arg PROFILE=workstation -t dotfiles-test .
+#   docker build --build-arg UBUNTU=22.04 --build-arg PROFILE=minimal -t dotfiles-test:22.04-minimal .
+#   docker build --build-arg PROFILE=workstation -t dotfiles-test:24.04-workstation .
 #
 # Iterative mode — mount live source, skip the build-time install:
-#   docker run --rm -it -v "$PWD":/root/dotfiles dotfiles-test bash
+#   docker build --build-arg PROFILE=docker -t dotfiles-test:24.04-docker .
+#   docker run --rm -it -v "$PWD":/root/dotfiles dotfiles-test:24.04-docker bash
 #   # then inside: cd ~/dotfiles && bash install.sh docker
 
 ARG UBUNTU=24.04