feat(brew): add hf and macOS app casks to chipwolf overlay

Adds the hf (Hugging Face) CLI and casks google-chrome, lm-studio,
mullvad-vpn, prismlauncher, slack, and claude-code. Organized into the
existing brew/cask sections alphabetically; lm-studio and slack are
promoted out of the disabled-comment block and yubico-authenticator is
moved into the active cask list.

claude-code is gated `PRIVATE` (in addition to mac) per the repo rule
that Claude/Anthropic tooling never lands in an unconditional overlay.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: ChipWolf

home/.chezmoidata/brew/10-chipwolf.yaml

@@ -43,6 +43,8 @@ brew:
           conditions:
             - { kind: os, op: is, value: mac }
             - { kind: env, name: PRIVATE, op: set }
+        - type: brew
+          name: hf # hugging face cli
         - type: brew
           name: sheeki03/tap/tirith # pre-exec command security scanner for hermes-agent
           conditions:
@@ -53,6 +55,11 @@ brew:
           conditions:
             - { kind: env, name: CODESPACES, op: unset }
 
+        - type: cask
+          name: claude-code # anthropic claude code (private machines only)
+          conditions:
+            - { kind: os, op: is, value: mac }
+            - { kind: env, name: PRIVATE, op: set }
         - type: cask
           name: eqmac
           conditions:
@@ -65,10 +72,34 @@ brew:
           name: gcloud-cli
           conditions:
             - { kind: os, op: is, value: mac }
+        - type: cask
+          name: google-chrome
+          conditions:
+            - { kind: os, op: is, value: mac }
+        - type: cask
+          name: lm-studio
+          conditions:
+            - { kind: os, op: is, value: mac }
         - type: cask
           name: lookaway # screen breaks
           conditions:
             - { kind: os, op: is, value: mac }
+        - type: cask
+          name: mullvad-vpn
+          conditions:
+            - { kind: os, op: is, value: mac }
+        - type: cask
+          name: prismlauncher
+          conditions:
+            - { kind: os, op: is, value: mac }
+        - type: cask
+          name: slack
+          conditions:
+            - { kind: os, op: is, value: mac }
+        - type: cask
+          name: yubico-authenticator
+          conditions:
+            - { kind: os, op: is, value: mac }
 
         # yamllint disable comments-indentation
         # Disabled/optional packages carried from legacy Brewfile comments.
@@ -103,22 +134,10 @@ brew:
         #   conditions:
         #     - { kind: os, op: is, value: mac }
         # - type: cask
-        #   name: lm-studio
-        #   conditions:
-        #     - { kind: os, op: is, value: mac }
-        # - type: cask
         #   name: macwhisper
         #   conditions:
         #     - { kind: os, op: is, value: mac }
         # - type: cask
-        #   name: slack
-        #   conditions:
-        #     - { kind: os, op: is, value: mac }
-        - type: cask
-          name: yubico-authenticator
-          conditions:
-            - { kind: os, op: is, value: mac }
-        # - type: cask
         #   name: zoom
         #   conditions:
         #     - { kind: os, op: is, value: mac }