feat(cli): replace the classic coreutils tools with modern equivalents

Adds Rust/Go replacements for the day-to-day utilities and shadows four of
them with aliases. Only read-only commands are shadowed (cat, du, df, ps), so a
wrong flag costs a retype rather than data; rm, grep, find and sed keep their
originals and the replacements are reached by their own names.

The aliases land in .zshrc, so they apply to interactive zsh only -- scripts,
`sudo <cmd>` and anything exec'd by another program still get the real binary.

New on every host: dust, dysk, procs, trash-cli, doggo, xh, ouch, jnv, hexyl,
fq and tealdeer. dysk is used rather than duf, which is unmaintained upstream.

git gains difftastic behind a `git dft` alias. diff.external is deliberately
left unset so delta remains the renderer for git diff/show and for anything
parsing them.

The work box gains kubecolor, aliased over kubectl; it wraps the real kubectl
and drops colour when stdout is not a terminal, so pipes are unchanged.

home/README.md documents the alias map, the flag incompatibilities (including
the two that fail silently: dust -s is --apparent-size, and procs reads a bare
`aux` as a search keyword) and the rationale for what was left alone.

users/emmathorpe/work.nix

@@ -50,6 +50,19 @@
   ];
   services.ssh-agent.enable = true;
 
+  # Colourised kubectl. enableAlias points `kubectl` at kubecolor, which parses
+  # the output of the real kubectl underneath and passes anything it does not
+  # recognise straight through, so every flag and subcommand still works. It
+  # drops colour automatically when stdout is not a terminal, leaving pipes into
+  # grep/jq/yq byte-identical. zsh integration reuses kubectl's own completions.
+  # Note the alias does apply to `KUBECONFIG=... kubectl ...`: zsh expands
+  # aliases after a variable-assignment prefix.
+  programs.kubecolor = {
+    enable = true;
+    enableAlias = true;
+    enableZshIntegration = true;
+  };
+
   # gcx (above) keeps its OAuth tokens in the system keychain and has no
   # plaintext fallback, so this WSL box needs something owning
   # org.freedesktop.secrets. See home/secret-service.nix for why