Polish ringtail NixOS config and add documentation (#208)

## Summary
- Fix Super+Return keybinding to launch wezterm in sway
- Set fish as default login shell
- Remove `initialPassword` (real password already set)
- Add 1Password CLI + GUI, chezmoi, and dev tool packages (neovim, eza, fd, fzf, zoxide, starship, atuin, bat, ripgrep)
- Add ringtail reference card, update host inventory and reference index
- Changelog fragment

## Post-merge deployment
- `mise run provision-ringtail` to rebuild NixOS
- On ringtail: launch 1Password GUI, enable CLI integration (Settings > Developer > CLI integration)
- Chezmoi needs `.chezmoiignore` updates in the dotfiles repo (separate task)

Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/208

ansible/playbooks/ringtail.yml

@@ -8,7 +8,7 @@
       ansible.builtin.git:
         repo: "https://forge.ops.eblu.me/eblume/blumeops.git"
         dest: /etc/blumeops
-        version: main
+        version: "{{ ringtail_commit | default('main') }}"
         force: true
       register: _repo
 
@@ -16,7 +16,7 @@
       ansible.builtin.command:
         cmd: nixos-rebuild switch --flake /etc/blumeops/nixos/ringtail#ringtail
       register: _rebuild
-      changed_when: "'activating the configuration' in _rebuild.stdout"
+      changed_when: "'activating the configuration' in _rebuild.stderr"
       when: _repo.changed
 
     - name: Verify tailscale is connected