* feat(colemak): Install Colemak keylayout via nix Replace the manual curl step in the README with a home-manager activation script that copies a hash-pinned fetchurl of the layout into ~/Library/Keyboard Layouts. Copied rather than symlinked since macOS does not reliably pick up symlinks there. * chore(git): Fetch from github, push to knot and github origin now fetches only from github (where PRs merge) while keeping the dual push to knot and github, so pulls are always current and a plain git push after git pull syncs both. Also adds the missing fetch refspec - without it git fetch origin never populated origin/* remote-tracking refs, so pull relied on FETCH_HEAD. * fix(ci): Pass github_token to claude review action claude-code-action unconditionally exchanges an OIDC token with api.anthropic.com for a GitHub App token unless a github_token input is provided. The job deliberately withholds id-token: write, so every run failed at setup. Pass the job's comment-only GITHUB_TOKEN instead; comments post as github-actions[bot] rather than the Claude app. * fix(ci): Grant claude review id-token instead of token override claude-code-action exchanges an OIDC token with api.anthropic.com for an app token (comments post as the Claude app). Fine to grant id-token: write since the job only runs for trusted authors (OWNER/MEMBER/COLLABORATOR). Reverts the github_token override. * fix(colemak): Replace symlink target instead of writing through it rm -f before cp so a pre-existing symlink at the layout path is replaced rather than written through (BSD cp has no --remove-destination). Also corrects the claude-review containment comment: the agent's credential is the app installation token, which the job permissions block does not scope.