test: container lab for the two-tier apply

A disposable ubuntu container, a fake private tier and a fake bootstrap
endpoint, so the whole documented path — chezmoi init --apply, dotup pick,
dotup private, cmp apply, dotsecrets — can run end to end without touching a
real machine or a real credential. The fake tier mirrors the real one's
structure (seven secrets and one alias) because dotsecrets is copied verbatim
and the "8 exports, not 7" assertion depends on that cardinality; its ids are
sequential and obviously synthetic.

check-verbatim.sh keeps the fake tier's copies of shipped files honest, and
snapshot.sh records file modes so a 644 where a 600 belongs is a diff.

.tests/lab/fake-private/private_dot_config/private_zsh/private_local.zsh.tmpl

@@ -0,0 +1,61 @@
+{{- $wanWeb := get . "giteaWanWeb" -}}
+{{- $lanWeb := get . "giteaLanWeb" -}}
+# ~/.config/zsh/local.zsh -- PRIVATE tier. Mode 600.
+#
+# Sourced by the public ~/.zshrc, guarded, near the end:
+#
+#   [[ -r ${XDG_CONFIG_HOME:-$HOME/.config}/zsh/local.zsh ]] && source ...
+#
+# Absent on a public-only machine, where the guard makes it a silent no-op.
+# `_mac` and `_open` from .zshrc are still in scope by the time this runs, so
+# an alias moved here needs no rewriting.
+#
+# What belongs here: anything that names a host you own. Nothing that is a
+# secret -- those come from ~/.config/zsh/secrets.zsh, written by `dotsecrets`
+# and carried in no repository at all.
+#
+# Mode 600 rather than 644, for the same reason .zshrc and .zshenv are: this is
+# code your login shell executes, and a group-writable copy of it is arbitrary
+# code execution for anyone in your primary group.
+
+# --------------------------------------------------------------- gitea ---
+# The web UI. The WAN host is a real name behind TLS; the LAN one is a bare
+# address on a port, reachable only from the house, which is precisely why it
+# cannot live in the public tier.
+{{ if $wanWeb }}alias gitea='_open {{ $wanWeb }}'{{ end }}
+{{ if $lanWeb }}alias gitea-lan='_open {{ $lanWeb }}'{{ end }}
+
+# The clone/push shortcuts are git-side, not shell-side: `gitea:` and
+# `gitea-lan:` are url.insteadOf rewrites in ~/.config/git/config.local, so
+# `git clone gitea:ben/repo.git` works from any shell, not just this one.
+
+# ------------------------------------------------------------- chezmoi ---
+# Two instances, one home directory. The public tier lays the base; the private
+# tier overlays identity on top. Both are ordinary chezmoi invocations with a
+# different --source, so every subcommand you know still works:
+#
+#   cm  status / cm  diff / cm  re-add ~/.zshrc      public
+#   cmp status / cmp diff / cmp apply                private
+#
+# Each tier has its own source AND its own config file:
+#
+#   public   `chezmoi init --apply <url>`, no flags   -> ~/.local/share/chezmoi
+#                                                       ~/.config/chezmoi/chezmoi.toml
+#   private  dotup, --source ... -c .../private.toml -> ~/.local/share/dotfiles-private
+#                                                       ~/.config/chezmoi/private.toml
+#
+# The -c is not cosmetic. Both tiers used to render their .chezmoi.toml.tmpl to
+# the same default path, so re-running the PUBLIC installer overwrote the config
+# holding this tier's seven promptStringOnce answers -- name, email, signing key,
+# the gitea addresses -- and they were gone. Silently: the templates degrade
+# politely when their data is missing, so the first symptom was `git commit` not
+# knowing who you are, days later and unconnected to the install that caused it.
+#
+# -S and -c must stay in step with dotup's PRIV_SRC and PRIV_CFG. If you move one,
+# move the other, or cmp reads a config that describes a different source tree.
+alias cm='chezmoi'
+alias cmp='chezmoi -S ${XDG_DATA_HOME:-$HOME/.local/share}/dotfiles-private -c ${XDG_CONFIG_HOME:-$HOME/.config}/chezmoi/private.toml'
+
+# Refresh ~/.config/zsh/secrets.zsh from Bitwarden Secrets Manager on demand.
+# `cmp apply` does the same thing via run_after_50-secrets.sh.
+#   dotsecrets