zsh: harden bootstrap against network failures and unsafe paths

- Add --connect-timeout 5 --max-time 30 to all curl calls (starship,
  lazydocker, fastfetch, eza) so an unreachable/slow host aborts instead
  of hanging the new shell during a bootstrap version bump
- Add -f/--fail to curl calls so a 502/HTML error page is not saved as
  a tarball or piped into sh
- Guard fastfetch extract: only cp/chmod when $ffdir is non-empty,
  preventing cp of '/usr/bin/fastfetch' and glob against '/' when
  curl/tar fails
- Only run fastfetch/eza copy steps when both curl and tar succeed;
  clean up temp tarballs in both success and failure paths
- git clone now uses GIT_TERMINAL_PROMPT=0 and http.lowSpeedLimit/
  lowSpeedTime so a stalled clone aborts after ~10s of no progress
  and an unexpected credential prompt cannot block startup
- Drop invalid -y flag from 'dnf list available' availability check
  (it is a global dnf option, not a list subcommand arg) which could
  cause the check to fail and skip the dnf path

zsh/zshrc

@@ -16,7 +16,7 @@ export ZSHRC_BOOTSTRAP="$ZSH_CONFIG/.bootstrapped"
 
 update_zshrc(){
   local tmp=/tmp/.zshrc.$$
-  curl -sSL --connect-timeout 5 --max-time 10 "$ZSHRC_URL" -o "$tmp" 2>/dev/null || return
+  curl -fsSL --connect-timeout 5 --max-time 10 "$ZSHRC_URL" -o "$tmp" 2>/dev/null || return
   if zsh -n "$tmp" 2>/dev/null && ! cmp -s "$tmp" "$HOME/.zshrc" 2>/dev/null; then
     echo "Updating zshrc..."
     mv "$tmp" "$HOME/.zshrc" && echo "Updated. Reloading..." && exec zsh
@@ -35,7 +35,7 @@ install_opencode(){
 # Bootstrap: download and run once per bootstrap version
 if [[ ! -f "$ZSHRC_BOOTSTRAP" || "$(cat "$ZSHRC_BOOTSTRAP" 2>/dev/null)" != "$ZSHRC_BOOTSTRAP_VERSION" || "$BOOTSTRAP" == "true" ]]; then
   tmp=/tmp/.zshrc_bootstrap.$$
-  curl -sSL --connect-timeout 5 --max-time 10 -o "$tmp" "$ZSHRC_BOOTSTRAP_URL" 2>/dev/null
+  curl -fsSL --connect-timeout 5 --max-time 10 -o "$tmp" "$ZSHRC_BOOTSTRAP_URL" 2>/dev/null
   if [[ -f "$tmp" ]]; then
     zsh "$tmp" 2>/dev/null
     echo "$ZSHRC_BOOTSTRAP_VERSION" > "$ZSHRC_BOOTSTRAP"
@@ -46,13 +46,13 @@ fi
 TMUXCONF="$HOME/.config/tmux"
 BYOBUCONF="$HOME/.config/byobu"
 TMUXREMOTE="$ZSHRC_GIT/tmux.conf"
-if [ ! -f "$TMUXCONF" ]; then
+if [ ! -f "$TMUXCONF/tmux.conf" ] && [ ! -f "$BYOBUCONF/.tmux.conf" ]; then
     # Create a secure temporary file
     TEMP_TMUXCONF=$(mktemp)
 
     # Download to temp file.
     # The '&&' ensures the 'mv' only runs if curl succeeds (exit code 0).
-    if curl -sSL --connect-timeout 5 --max-time 10 -o "$TEMP_TMUXCONF" "$TMUXREMOTE"; then
+    if curl -fsSL --connect-timeout 5 --max-time 10 -o "$TEMP_TMUXCONF" "$TMUXREMOTE"; then
         mkdir -p "$TMUXCONF" "$BYOBUCONF"
         cp "$TEMP_TMUXCONF" "$TMUXCONF/tmux.conf"
         mv "$TEMP_TMUXCONF" "$BYOBUCONF/.tmux.conf"
@@ -130,7 +130,7 @@ alias yeet='yay -Rcs'
 # Auto-update: check every shell start, silently fail if server unreachable
 if [[ -o interactive ]]; then
   tmp=/tmp/.zshrc.$$
-  curl -sSL --connect-timeout 3 --max-time 8 "$ZSHRC_URL" -o "$tmp" 2>/dev/null
+  curl -fsSL --connect-timeout 3 --max-time 8 "$ZSHRC_URL" -o "$tmp" 2>/dev/null
   if [[ -f "$tmp" ]] && zsh -n "$tmp" 2>/dev/null && ! cmp -s "$tmp" "$HOME/.zshrc" 2>/dev/null; then
     echo "Updating zshrc..."
     mv "$tmp" "$HOME/.zshrc" && exec zsh

zsh/zshrc-bootstrap.zsh

@@ -15,7 +15,7 @@ for p in git starship fzf eza rsync lazydocker fastfetch tmux; do
   if command -v apt >/dev/null && apt-cache show $p >/dev/null 2>&1; then
     echo "Installing $p using Apt" && sudo apt install $p -y && continue
   fi
-  if command -v dnf >/dev/null && dnf list available -y $p >/dev/null 2>&1; then
+  if command -v dnf >/dev/null && dnf list available $p >/dev/null 2>&1; then
     echo "Installing $p using dnf" && sudo dnf install $p -y && continue
   fi
   if command -v pacman >/dev/null && pacman -Si $p >/dev/null 2>&1; then
@@ -28,12 +28,12 @@ done
 
 if ! command -v starship >/dev/null; then
   echo "Installing starship binary..." && \
-  curl -sSL https://starship.rs/install.sh | sh -s -- -b ~/.local/bin -y >/dev/null 2>&1
+  curl -fsSL --connect-timeout 5 --max-time 30 https://starship.rs/install.sh | sh -s -- -b ~/.local/bin -y >/dev/null 2>&1
 fi
 
 if ! command -v lazydocker >/dev/null; then
   echo "Installing lazydocker binary..." && \
-  curl -sSL https://raw.githubusercontent.com/jesseduffield/lazydocker/master/scripts/install_update_linux.sh | \
+  curl -fsSL --connect-timeout 5 --max-time 30 https://raw.githubusercontent.com/jesseduffield/lazydocker/master/scripts/install_update_linux.sh | \
   DIR=$HOME/.local/bin bash >/dev/null 2>&1
 fi
 
@@ -46,27 +46,39 @@ esac
 
 if [[ -n $target_fast && -n $target_eza ]]; then
   if ! command -v fastfetch >/dev/null; then
-    curl -sSL -o /tmp/fastfetch.tar.gz "https://github.com/fastfetch-cli/fastfetch/releases/latest/download/fastfetch-${target_fast}.tar.gz"
-    tar -xzf /tmp/fastfetch.tar.gz -C /tmp
-    ffdir=$(find /tmp -maxdepth 1 -type d -name 'fastfetch*' | head -1)
-    cp "$ffdir/usr/bin/fastfetch" "$HOME/.local/bin/"
-    chmod +x "$HOME/.local/bin/fastfetch"
-    mkdir -p "$HOME/.local/share/fastfetch"
-    cp -r "$ffdir/usr/share/fastfetch/"* "$HOME/.local/share/fastfetch/"
-    rm -rf "$ffdir" /tmp/fastfetch.tar.gz
+    if curl -fsSL --connect-timeout 5 --max-time 30 -o /tmp/fastfetch.tar.gz \
+        "https://github.com/fastfetch-cli/fastfetch/releases/latest/download/fastfetch-${target_fast}.tar.gz" \
+        && tar -xzf /tmp/fastfetch.tar.gz -C /tmp 2>/dev/null; then
+      ffdir=$(find /tmp -maxdepth 1 -type d -name 'fastfetch*' | head -1)
+      if [[ -n "$ffdir" ]]; then
+        cp "$ffdir/usr/bin/fastfetch" "$HOME/.local/bin/"
+        chmod +x "$HOME/.local/bin/fastfetch"
+        mkdir -p "$HOME/.local/share/fastfetch"
+        cp -r "$ffdir/usr/share/fastfetch/"* "$HOME/.local/share/fastfetch/"
+      fi
+      rm -rf "$ffdir" /tmp/fastfetch.tar.gz
+    else
+      rm -f /tmp/fastfetch.tar.gz
+    fi
   fi
 
   if ! command -v eza >/dev/null; then
-    curl -sSL -o /tmp/eza.tar.gz "https://github.com/eza-community/eza/releases/latest/download/eza_${target_eza}.tar.gz"
-    tar -xzf /tmp/eza.tar.gz -C "$HOME/.local/bin/"
-    chmod +x "$HOME/.local/bin/eza"
+    if curl -fsSL --connect-timeout 5 --max-time 30 -o /tmp/eza.tar.gz \
+        "https://github.com/eza-community/eza/releases/latest/download/eza_${target_eza}.tar.gz" \
+        && tar -xzf /tmp/eza.tar.gz -C "$HOME/.local/bin/" 2>/dev/null; then
+      chmod +x "$HOME/.local/bin/eza"
+    else
+      echo "Warning: failed to download eza" >&2
+    fi
     rm -f /tmp/eza.tar.gz
   fi
 fi
 
 mkdir -p "$HOME/.config/zsh"
 
-[ ! -d $OHMYZSH ] && git clone --depth=1 https://github.com/ohmyzsh/ohmyzsh.git $OHMYZSH
+[ ! -d $OHMYZSH ] && \
+  GIT_TERMINAL_PROMPT=0 git -c http.lowSpeedLimit=1000 -c http.lowSpeedTime=10 \
+    clone --depth=1 https://github.com/ohmyzsh/ohmyzsh.git $OHMYZSH
 
 for plug in \
   "zsh-autosuggestions|https://github.com/zsh-users/zsh-autosuggestions" \
@@ -76,7 +88,9 @@ do
   name="${plug%%|*}"
   url="${plug##*|}"
   dir="$OHMYZSH_CUSTOM/plugins/$name"
-  [[ ! -d "$dir" ]] && git clone "$url" "$dir" 2>/dev/null
+  [[ ! -d "$dir" ]] && \
+    GIT_TERMINAL_PROMPT=0 git -c http.lowSpeedLimit=1000 -c http.lowSpeedTime=10 \
+      clone "$url" "$dir" 2>/dev/null
 done
 
 # Cleanup