Add work-specific configs and enhance git/shell setup

- Add modular zsh configs: zshrc-dev for dev tools, zshrc-natera for work
- Add .gitignore to exclude private Natera config from version control
- Configure git commit signing and delta diff viewer in gitconfig
- Regenerate p10k.zsh with rainbow theme and improved visual settings
- Add HIST_IGNORE_SPACE option to prevent saving sensitive commands
- Document Natera machine setup with private config template in README

zshrc-natera.private.example

@@ -0,0 +1,21 @@
+# Natera-sensitive configuration (do not commit the real file)
+# Copy this file to zshrc-natera.private and fill in the placeholders.
+# zshrc-natera.private is gitignored.
+
+# AWS profile (contains account ID)
+export AWS_PROFILE="YOUR_AWS_PROFILE_NAME"
+
+# OpenTelemetry endpoint (internal)
+export OTEL_EXPORTER_OTLP_ENDPOINT="http://YOUR_OTEL_ENDPOINT:4318"
+
+# Netskope TLS cert bundle path (Natera corp)
+export AWS_CA_BUNDLE=~/.aws/nskp_config/netskope-cert-bundle.pem
+export REQUESTS_CA_BUNDLE=~/.aws/nskp_config/netskope-cert-bundle.pem
+export SSL_CERT_FILE=~/.aws/nskp_config/netskope-cert-bundle.pem
+export NODE_EXTRA_CA_CERTS=~/.aws/nskp_config/netskope-cert-bundle.pem
+
+# Refresh: close tunnel if open, then SSO login + jumpbox + boring open (replace placeholders)
+refresh() {
+  boring close YOUR_BORING_TARGET 2>/dev/null
+  aws sso login && ssh -i ~/work/pems/YOUR_JUMPBOX_PEM ec2-user@JUMPBOX_IP exit && boring open YOUR_BORING_TARGET
+}