Establish host profiles and review-first chezmoi adoption workflow

## Parent

Parent: #1

## What to build

Establish the review-first chezmoi adoption foundation for the portable user environment.

This slice should add the non-secret host-profile contract for `macbook` and `ubuntu-vps`, source-level ignore rules, and short operator documentation for safely rendering, diffing, dry-running, and applying managed files. It should make host/profile decisions explicit without taking broad ownership of existing local configuration.

## Acceptance criteria

- [ ] First-run chezmoi data captures non-secret host facts such as profile, host instance name, package manager, GUI expectation, 1Password mode, 1Password SSH-agent support, Git signing preference/mode, and login bridge preference.
- [ ] The implementation prefers reusable profile data over hostname-specific branching.
- [ ] `macbook` and `ubuntu-vps` are represented as the initial supported host profiles.
- [ ] Coarse ignore rules prevent documentation, planning assets, and host-inapplicable files from being applied as home-directory targets.
- [ ] Operator documentation explains the review-first workflow: render, diff, dry-run, apply only reviewed targets, and validate behavior.
- [ ] Existing differing target files are not overwritten automatically as part of first-run adoption.
- [ ] No secrets, service-account tokens, private keys, or generated 1Password state are stored in chezmoi-managed files.

## Blocked by

None - can start immediately

No files or tests are named, so start by locating the repo’s chezmoi entry points (first-run config, host/profile templates, and ignore handling) that control onboarding behavior. Update those areas to add the non-secret macbook and ubuntu-vps host profiles and coarse ignore rules, then add operator documentation describing render, diff, dry-run, and apply for reviewed targets only. Validate by running the workflow for each profile, confirming differing existing files are reported but not auto-overwritten and no secrets or generated 1Password state end up in managed files.

Escrita pelo modelo de indexação a partir do texto da issue.