feat(cli): replace the classic coreutils tools with modern equivalents

Adds Rust/Go replacements for the day-to-day utilities and shadows four of
them with aliases. Only read-only commands are shadowed (cat, du, df, ps), so a
wrong flag costs a retype rather than data; rm, grep, find and sed keep their
originals and the replacements are reached by their own names.

The aliases land in .zshrc, so they apply to interactive zsh only -- scripts,
`sudo <cmd>` and anything exec'd by another program still get the real binary.

New on every host: dust, dysk, procs, trash-cli, doggo, xh, ouch, jnv, hexyl,
fq and tealdeer. dysk is used rather than duf, which is unmaintained upstream.

git gains difftastic behind a `git dft` alias. diff.external is deliberately
left unset so delta remains the renderer for git diff/show and for anything
parsing them.

The work box gains kubecolor, aliased over kubectl; it wraps the real kubectl
and drops colour when stdout is not a terminal, so pipes are unchanged.

home/README.md documents the alias map, the flag incompatibilities (including
the two that fail silently: dust -s is --apparent-size, and procs reads a bare
`aux` as a search keyword) and the rationale for what was left alone.

home/git.nix

@@ -74,6 +74,11 @@ in
         # `cz commit`, `git cz bump`, etc. `git cc` is a shortcut for the prompt.
         cz = "!cz";
         cc = "!cz commit";
+        # Structural (syntax-aware) diff, on demand. Set per-invocation via the
+        # environment rather than `diff.external`, which would also change what
+        # `git show` and `git log -p --ext-diff` emit for every caller.
+        # Takes the same arguments as `git diff`: `git dft HEAD~3 -- file`.
+        dft = "!GIT_EXTERNAL_DIFF=difft git diff";
       };
 
       # SSH signing, key from the registry. mkDefault so a host lacking the key
@@ -99,6 +104,14 @@ in
     enableGitIntegration = true;
   };
 
+  # difftastic backs the `dft` alias above. git.enable stays off on purpose:
+  # the module's git integration sets `diff.external`, which would displace
+  # delta as the diff renderer everywhere instead of only where asked.
+  programs.difftastic = {
+    enable = true;
+    git.enable = false;
+  };
+
   # lazygit: TUI for staging/rebasing, themed to Catppuccin Mocha to match.
   programs.lazygit = {
     enable = true;