Support zsh-ai-cmd API key storage on Linux

[jdevera]

Context

The run_onchange_after_keychain-anthropic.sh script currently stores the Anthropic API key from 1Password into macOS Keychain for the zsh-ai-cmd plugin. The script skips on Linux.

Goal

Support secure API key storage on Linux for the zsh-ai-cmd plugin, covering:

• Headful (Fedora) — GNOME Keyring via secret-tool (libsecret) is the natural choice. Works without password prompts in a logged-in desktop session.
• Headless (Debian) — harder. Options include:
  • secret-tool with pam_gnome_keyring to auto-unlock on login
  • pass (password-store) with a GPG agent caching the passphrase
  • Encrypted file with age or gpg and a cached key

Tasks

• Pick a Linux keyring approach that works for both headful and headless
• Update or create a Linux-specific chezmoi script to store the key
• Set ZSH_AI_CMD_API_KEY_COMMAND per-OS in the plugin config (or use ZSH_AI_CMD_KEYCHAIN_NAME if a keyring CLI matches the same lookup pattern)
• Make the plugin config in 007_plugin_config.zsh a template if OS-specific logic is needed