dotfiles module: install the cfg alias via ~/.bash_aliases (VM: command not found)

The alias only existed where it was typed by hand; a fresh VM with
dots cloned had no cfg command. The module now always ensures:
- ~/.bash_aliases holds the cfg alias (created if absent)
- ~/.bashrc sources ~/.bash_aliases (appended if absent)
Runs before the already-installed skip so existing machines get it
too. Idempotent both ways (harness-proven: single alias line, single
source line after two runs; verified working in an interactive shell:
'type cfg' resolves and 'cfg status' runs).

~/.bash_aliases is the right file to TRACK in fedora-dots next: it
will then sync further aliases across machines.

modules/user/dotfiles.sh

@@ -17,8 +17,34 @@ if [[ ! -d "$HOME/.config" ]]; then
     mkdir -p "$HOME/.config"
 fi
 
+# --- Install the cfg command, ALWAYS (even if the repo exists already) ---
+# The alias lives in ~/.bash_aliases (user-owned, trackable in fedora-dots),
+# and ~/.bashrc sources that file. Without this, `cfg` exists only on the
+# machine where it was typed by hand (VM-proven: "cfg pull: command not found").
+ALIASES_FILE="$HOME/.bash_aliases"
+BASHRC="$HOME/.bashrc"
+
+if ! grep -q "alias cfg=" "$ALIASES_FILE" 2>/dev/null; then
+    info "Installing cfg alias into ~/.bash_aliases..."
+    cat >> "$ALIASES_FILE" <<'EOF'
+# cfg: manage the bare dotfiles repo (~/.cfg.git, work tree $HOME)
+alias cfg='git --git-dir=$HOME/.cfg.git --work-tree=$HOME'
+EOF
+fi
+
+if ! grep -q "bash_aliases" "$BASHRC" 2>/dev/null; then
+    info "Making ~/.bashrc load ~/.bash_aliases..."
+    touch "$BASHRC"
+    cat >> "$BASHRC" <<'EOF'
+
+# user aliases
+if [ -f ~/.bash_aliases ]; then . ~/.bash_aliases; fi
+EOF
+fi
+
 if [[ -d "$CFG_DIR" ]]; then
-    ok "Dotfiles already set up ($CFG_DIR exists). Skipping."
+    ok "Dotfiles already set up ($CFG_DIR exists)."
+    ok "cfg alias ensured. Open a new shell or run: source ~/.bashrc"
     exit 0
 fi