fix(setup): mirror nvm init into .zshrc so zsh sees node + pnpm

On the dev VM, 20-zsh.sh hands off to zsh via an exec in .bashrc
(chsh is blocked on the corp VM), and 40-node.sh's nvm installer only
patches .bashrc. The hand-off execs zsh before the nvm block runs and
.zshrc has no nvm init, so zsh sessions get neither node nor pnpm on
PATH on a fresh clone.

40-node.sh now appends an idempotent nvm-init block to .zshrc after
corepack enable (same marker pattern 20-zsh.sh uses for .bashrc).
Document the .zshrc patch in the bootstrap table.

Already-provisioned VMs: re-run 40-node.sh (marker-safe) or append the
block manually.

docs/setup/scripts/40-node.sh

@@ -53,4 +53,27 @@ if [[ -f "$REPO_ROOT/package.json" ]]; then
   popd >/dev/null
 fi
 
+# The nvm installer appends its init to ~/.bashrc only. But the
+# interactive shell on this VM is zsh: 20-zsh.sh hands off via
+# `exec zsh -l` (chsh is blocked on the corp VM). That hand-off execs
+# zsh *before* the nvm block in ~/.bashrc runs, and the nvm installer
+# leaves ~/.zshrc untouched — so without this, zsh sessions have
+# neither node nor pnpm on PATH. Mirror the nvm init into ~/.zshrc
+# (idempotent via marker, same pattern as 20-zsh.sh's .bashrc patch).
+ZSHRC="$HOME/.zshrc"
+[[ -f "$ZSHRC" ]] || touch "$ZSHRC"
+NVM_MARKER='# Managed by docs/setup/scripts/40-node.sh — nvm init for zsh.'
+if grep -qF "$NVM_MARKER" "$ZSHRC"; then
+  skip "nvm init already in $ZSHRC."
+else
+  cat >> "$ZSHRC" <<'EOF'
+
+# Managed by docs/setup/scripts/40-node.sh — nvm init for zsh.
+export NVM_DIR="$HOME/.nvm"
+[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
+[ -s "$NVM_DIR/bash_completion" ] && \. "$NVM_DIR/bash_completion"
+EOF
+  ok "Patched $ZSHRC with nvm init."
+fi
+
 log "Reload your shell (exec zsh -l) so nvm + node + pnpm are on PATH."