feat: set ephemeral flag inside containers

.chezmoi.toml.tmpl

@@ -1,5 +1,19 @@
-{{- $github_email := promptStringOnce . "github_email" "Github Email address" -}}
-{{- $machineClass := promptChoiceOnce . "machineClass" "Machine class (private/server/public)" (list "private" "server" "public") -}}
+# Check if this runs in an ephemeral container, e.g. builder, devcontainer, etc.
+{{- $ephemeralOverride := env "CHEZMOI_EPHEMERAL" -}}
+{{- $ephemeral := or (eq $ephemeralOverride "1") (eq $ephemeralOverride "true") -}}
+{{- if not $ephemeralOverride -}}
+{{-   $ephemeral = or (not stdinIsATTY) (ne (env "CODESPACES") "") (eq .chezmoi.username "vscode") -}}
+{{- end -}}
+
+{{- $github_email := "" -}}
+{{- $machineClass := "" -}}
+{{- if $ephemeral -}}
+{{-   $github_email = env "CHEZMOI_GITHUB_EMAIL" -}}
+{{-   $machineClass = env "CHEZMOI_MACHINE_CLASS" | default "public" -}}
+{{- else -}}
+{{-   $github_email = promptStringOnce . "github_email" "Github Email address" -}}
+{{-   $machineClass = promptChoiceOnce . "machineClass" "Machine class (private/server/public)" (list "private" "server" "public") -}}
+{{- end -}}
 
 encryption = "age"
 [age]
@@ -9,4 +23,4 @@ encryption = "age"
 [data]
     github_email = {{ $github_email | quote }}
     machineClass = {{ $machineClass | quote }}
-    ephemeral = {{ $ephemeral }}
+    ephemeral = {{ $ephemeral }}

CLAUDE.md

@@ -34,10 +34,9 @@ There is no build, lint, or test suite — this is a config repo. "Testing" a ch
 ## Architecture
 
 - **`run_onchange_before_NN_*.sh`** — idempotent setup scripts chezmoi re-runs whenever their content hash changes, in numeric order (`0` installs apt packages, `1` sets zsh as default shell and installs antidote, `20`+ install individual tools: fzf, diff-so-fancy, vim-plug, tmux plugin manager, lazygit, fonts, nbdime). New machine-setup steps should follow this pattern: a numbered `run_onchange_before_*.sh` with `set -euo pipefail` and an existence check so re-runs are no-ops.
-- **`.chezmoi.toml.tmpl`** — chezmoi's own config template; prompts once for `github_email` and enables `autoCommit`/`autoPush` on `chezmoi apply` (so applying on a configured machine also commits/pushes to this repo — be aware of that when testing changes there).
-- **`.commit_message.tmpl`** — template chezmoi uses to prompt for the commit message when autoCommit fires.
+- **`.chezmoi.toml.tmpl`** — chezmoi's own config template. Interactively prompts once for `github_email`/`machineClass` on a real terminal; when non-interactive (`stdinIsATTY` false), `CODESPACES` is set, or `.chezmoi.username` is `vscode` — auto-detected as `ephemeral`, overridable via `CHEZMOI_EPHEMERAL` — it skips prompting and instead reads `CHEZMOI_GITHUB_EMAIL` (may be left empty) and `CHEZMOI_MACHINE_CLASS` (defaults to `public`). `ephemeral` is written to `[data]` alongside `machineClass`/`github_email` and gates lifecycle-only setup (fonts — see `run_onchange_before_25_fonts.sh.tmpl`). `chezmoi apply` never auto-commits/pushes to this repo on any machine; sync manually per the Commands section below.
 - **Shell startup chain**: `dot_zshrc` sources `bin/term-background` (must run before the p10k instant-prompt block, since it reads the tty for OSC 11 background detection) → p10k instant prompt → `~/.environment`(`dot_environment`) + optional `~/.environment.local` → `~/.aliases` (`dot_aliases`) + optional `~/.aliases.local` → antidote plugin load (plugin list in `dot_zsh_plugins.txt`) → `~/.p10k.zsh`. The `.local` files are gitignored, host-specific overrides — never add machine-specific values directly to the tracked files.
-- **`dot_gitconfig.tmpl`** — templated on `.github_email`; wires up diff-so-fancy as the pager and nbdime for Jupyter notebook diffing. `~/.gitconfig.local` (untracked) is included for machine-specific overrides.
+- **`dot_gitconfig.tmpl`** — templated on `.github_email`, whose `[user] email` line is omitted entirely when `.github_email` is empty (e.g. an ephemeral machine with no `CHEZMOI_GITHUB_EMAIL` set); wires up diff-so-fancy as the pager and nbdime for Jupyter notebook diffing. `~/.gitconfig.local` (untracked) is included for machine-specific overrides.
 - **`private_dot_config/`** → installs to `~/.config/` with restrictive permissions (nvim, matplotlib styles, fontconfig).
 - **`bin/`** → installs to `~/bin/`; `executable_term-background` detects terminal light/dark background via OSC 11 for theme-matching in nvim etc.
 - **`.chezmoiignore`** lists source-repo-only paths (`README.md`, `.codex`, `.agents`, `CLAUDE.md`, `CLAUDE.local.md`, `key.txt.age`) that chezmoi should never install to `$HOME`, plus a `machineClass`-gated conditional excluding `.ssh/config.d/home`, `.ssh/config.d/web`, and `.claude/settings.json` on any machine that isn't `machineClass = "private"` — `~/.claude/settings.json` has no user-level `.local.json` merge mechanism, so machines with differing Claude Code config (e.g. `enabledPlugins`) manage that file by hand instead of via chezmoi.

dot_gitconfig.tmpl

@@ -2,7 +2,9 @@
 [user]
 # Please adapt and uncomment the following lines:
     name = Daniel Bauer
+{{- if .github_email }}
     email = {{ .github_email | quote }}
+{{- end }}
 [core]
     pager = sh -c 'command -v diff-so-fancy >/dev/null && exec diff-so-fancy || less --tabs=4 -RX'
 	autocrlf = input