[chianyungcode]

Summary

• Skip Age-encrypted targets and the 1Password-dependent Hermes environment file during secretless CI runs.
• Exercise the CI rendering path with workstation data where encrypted files are enabled, and include macOS render cases.
• Add the Merino Dark terminal theme and update Ghostty/WezTerm to use it.
• Adjust Kanata tmux hold mappings and Rex key sequences.

Validation

• bash -n tests/chezmoi-render-config.sh
• git diff --check origin/main...HEAD