Add work-specific configs and enhance git/shell setup

- Add modular zsh configs: zshrc-dev for dev tools, zshrc-natera for work
- Add .gitignore to exclude private Natera config from version control
- Configure git commit signing and delta diff viewer in gitconfig
- Regenerate p10k.zsh with rainbow theme and improved visual settings
- Add HIST_IGNORE_SPACE option to prevent saving sensitive commands
- Document Natera machine setup with private config template in README

README.md

@@ -119,7 +119,19 @@ The Brewfile installs **MesloLGS NF** (Nerd Font). Set this as your terminal fon
 - **iTerm2**: Preferences > Profiles > Text > Font > MesloLGS NF
 - **Terminal.app**: Preferences > Profiles > Font > Change > MesloLGS NF
 
-## 13. Set up work git identity
+## 13. Optional: Natera / work machine setup
+
+On Natera machines, the main `zshrc` automatically sources `~/dotfiles/zshrc-natera` if that file exists. That file adds work-specific aliases, Claude/Bedrock and OTEL env vars, and a `refresh` command for SSO + tunnel.
+
+To enable the parts that use sensitive values (AWS profile, OTEL endpoint, Netskope cert paths, tunnel details), create a **private** config file that is gitignored and never committed:
+
+```bash
+cp ~/dotfiles/zshrc-natera.private.example ~/dotfiles/zshrc-natera.private
+```
+
+Edit `zshrc-natera.private` and replace the placeholders with your real values. `zshrc-natera` sources this file when present.
+
+## 14. Set up work git identity
 
 The `.gitconfig` uses your personal email by default. For work repos, create `~/.gitconfig-work`:
 
@@ -132,7 +144,7 @@ EOF
 
 Any repos cloned under `~/work/` will automatically use your work email. Clone personal projects elsewhere.
 
-## 14. Language version managers
+## 15. Language version managers
 
 The dotfiles configure these version managers — install runtimes as needed:
 
@@ -163,7 +175,10 @@ The `bin/` directory contains custom git subcommands that are symlinked into `~/
 
 | File | Purpose |
 |------|---------|
-| `zshrc` | Main zsh config: plugins, aliases, key bindings, functions |
+| `zshrc` | Main zsh config: plugins, aliases, key bindings; sources `zshrc-dev` and `zshrc-natera` when present |
+| `zshrc-dev` | Developer enhancements (optional): rg wrapper, git helpers, project helpers |
+| `zshrc-natera` | Natera-specific config (optional): work aliases, Claude/Bedrock, OTEL; sources `zshrc-natera.private` when present |
+| `zshrc-natera.private.example` | Template for sensitive Natera values; copy to `zshrc-natera.private` and fill in (gitignored) |
 | `zshenv` | PATH and version manager init (runs for all shell types) |
 | `p10k.zsh` | Powerlevel10k prompt theme config |
 | `bashrc` | Bash config (NVM, Docker, fzf) |