fix(chezmoi): handle .chezmoiroot in autocmd pattern

Extends previous fix to also cover the BufRead/BufNewFile autocmd
pattern for chezmoi.nvim file watching.

Changes:
- Extract source path resolution to shared `source_dir` variable
- Use `chezmoi source-path` CLI when available (canonical solution)
- Fallback with path normalization (vim.fs.normalize, vim.fs.joinpath)
- Reject path traversal patterns (..) for security
- Handle edge cases: leading ./, trailing slashes, etc.

lua/lazyvim/plugins/extras/util/chezmoi.lua

@@ -1,3 +1,24 @@
+-- Resolve source path, respecting .chezmoiroot
+local source_dir = (function()
+  local out = vim.fn.system("chezmoi source-path")
+  if vim.v.shell_error == 0 then
+    return vim.trim(out)
+  end
+  local base = vim.env.HOME .. "/.local/share/chezmoi"
+  local f = io.open(base .. "/.chezmoiroot", "r")
+  if f then
+    local root = f:read("*l")
+    f:close()
+    if root then
+      root = vim.fs.normalize(vim.trim(root), { expand_env = false })
+      if root ~= "" and not root:find("..", 1, true) then
+        return vim.fs.joinpath(base, root)
+      end
+    end
+  end
+  return base
+end)()
+
 local pick_chezmoi = function()
   if LazyVim.pick.picker.name == "telescope" then
     require("telescope").extensions.chezmoi.find_files()
@@ -55,18 +76,7 @@ return {
     "alker0/chezmoi.vim",
     init = function()
       vim.g["chezmoi#use_tmp_buffer"] = 1
-      -- Handle .chezmoiroot for users who organize source files in subdirectories
-      local source = vim.env.HOME .. "/.local/share/chezmoi"
-      local root_file = source .. "/.chezmoiroot"
-      local f = io.open(root_file, "r")
-      if f then
-        local root = f:read("*l")
-        f:close()
-        if root and root ~= "" then
-          source = source .. "/" .. vim.trim(root)
-        end
-      end
-      vim.g["chezmoi#source_dir_path"] = source
+      vim.g["chezmoi#source_dir_path"] = source_dir
     end,
   },
   {
@@ -96,7 +106,7 @@ return {
     init = function()
       -- run chezmoi edit on file enter
       vim.api.nvim_create_autocmd({ "BufRead", "BufNewFile" }, {
-        pattern = { vim.env.HOME .. "/.local/share/chezmoi/*" },
+        pattern = { source_dir .. "/*" },
         callback = function()
           vim.schedule(require("chezmoi.commands.__edit").watch)
         end,