fix: install bws, isolate the private config, keep credentials out of logs

Three defects the private tier could not survive a fresh machine with.

bws was never installed. The private/bws-secrets row promised seven API
keys and shipped no way to fetch them: dotsecrets shells out to `bws
secret get`, and nothing put that binary on the box. Added as a tarball
channel with checksum verification, musl rather than gnu so it does not
pin a glibc newer than an older LTS carries, plus core/unzip as a real
@needs dependency since the release is a .zip and 24.04 minimal has no
unzip. The releases API needs filtering by tag prefix: sdk-sm is a
monorepo and `latest` usually points at a python SDK, not bws.

Both tiers rendered their config to ~/.config/chezmoi/chezmoi.toml, so
re-running the public installer overwrote the private config and took its
seven promptStringOnce answers with it. Silently -- the templates degrade
politely when data is missing, so the symptom was `git commit` not knowing
who you are, days later. The private tier now renders to private.toml and
the cmp alias carries the matching -c.

`run` echoes its argv to stderr, and the private init argv ends in
https://user:TOKEN@host -- into scrollback, any `dotup 2>log`, and any
agent transcript. Traced through redact_url instead, in both the live and
dry-run branches. The clone is also chmod -R go-rwx afterwards: it lands
at the caller umask, and .git/config stores that same credential URL.

Tests: 90 passing, 9 new covering all three.

dot_local/share/dotup/packages.tsv

@@ -31,6 +31,7 @@
 @needs	agents/specify-cli	core/uv
 @needs	core/mermaid-cli	core/node
 @needs	core/neovim	core/imagemagick core/mermaid-cli
+@needs	private/bws-secrets	core/unzip
 #
 # npm names carry scopes that the plugin's short name does not. `npm i -g
 # rpiv-btw` installs somebody else's package.
@@ -63,6 +64,7 @@ core	mermaid-cli	safe	-npm	-npm	mmdc — nvim renders mermaid fences with it
 core	btop	safe	btop	btop
 core	htop	safe	htop	htop
 core	ncdu	safe	ncdu	ncdu
+core	unzip	safe	unzip	unzip	the bws release ships as a .zip, and 24.04 minimal has no unzip
 core	tree	safe	tree	tree
 core	cmake	safe	cmake	cmake
 core	ninja	safe	ninja-build	ninja	package name differs from binary
@@ -116,4 +118,4 @@ virt	libvirt	invasive	libvirt-daemon-system	-	daemon + group membership
 virt	virt-manager	invasive	virt-manager	-
 @private	one password, typed after the install finishes
 private	private-repo	private	-	-	~/.local/share/dotfiles-private — agent config, ssh config
-private	bws-secrets	private	-	-	7 API keys into ~/.config/zsh/secrets.zsh
+private	bws-secrets	private	-tarball	-tarball	installs bws, then 7 API keys into ~/.config/zsh/secrets.zsh