twpayne/chezmoi ? reverse-engineered prompt

I want to build a command-line tool to help me manage my dotfiles across all my machines. It should work on macOS, Windows, and Linux since I use all three. I'm tired of manually syncing my .zshrc, .gitconfig, and other files. The main idea is to store all my configs in a single Git repository, and then use this tool to apply them to any new machine I set up.

It needs to be smart enough to handle small differences between machines, like a different username or a specific setting for my work computer vs. my personal one. Security is really important, so it should be able to pull secrets like API keys from a password manager instead of storing them directly in my dotfiles repo. The final output should be a single, fast binary that's easy to install, so something written in Go would be great. Please include niceties like shell completion for bash and zsh.