Clean broken managed links before chezmoi apply

[jsilverdev]

Summary

• clean broken symlinks/reparse points only when they block a destination currently managed by chezmoi
• inspect parent path components under the user home so a broken legacy directory link cannot block a managed child
• never traverse valid symlinks/reparse points and leave unrelated broken links untouched
• perform cleanup before the bootstrap apply on Linux and Windows
• preserve existing-source bootstrap behavior by pulling the source before cleanup/apply
• add Debian/Arch and Windows/AllSigned migration fixtures and assertions

Local validation

Linux behavior was validated locally before pushing with mocked chezmoi managed output, covering:

• exact managed broken symlink
• broken parent of a managed target
• unrelated broken symlink preservation
• valid symlink traversal prevention
• paths containing spaces
• idempotent repeated cleanup
• new-source ordering: init -> cleanup -> apply -> installer
• existing-source ordering: pull -> cleanup -> apply -> installer

Docker/Podman and PowerShell are not available in the local execution environment, so Windows behavior is validated by the existing Windows and AllSigned GitHub Actions jobs.