Add reference links: chezmoi, age, duckdb, launchd, age-spec, task-durations companion repo

docs/architecture.md

@@ -2,6 +2,8 @@
 
 This template provides a two-way dotfile sync across N macOS machines. Every change you make on any machine propagates to the others within ~7 minutes. There's no central server — each machine is a peer.
 
+Underlying technologies: [`chezmoi`](https://www.chezmoi.io) ([reference](https://www.chezmoi.io/reference/)) for templating + applying dotfiles, [`age`](https://github.com/FiloSottile/age) for encrypting secrets at rest, and [launchd](https://www.launchd.info/) for the daemons that fire on file change and on a 5-minute timer.
+
 ## Three moving parts
 
 ```

docs/security.md

@@ -2,6 +2,8 @@
 
 What's encrypted, what isn't, and where each line is drawn.
 
+Encryption uses [age](https://github.com/FiloSottile/age) ([format spec](https://age-encryption.org/v1)). [chezmoi's age integration docs](https://www.chezmoi.io/user-guide/encryption/age/) describe how `chezmoi add --encrypt` works and how the recipient public key is configured.
+
 ## Encryption boundaries
 
 | Lives where | Encrypted at rest? | Why |

docs/setup-new-fleet.md

@@ -8,6 +8,8 @@ If you'd rather have an agent (Claude Code, Codex, etc.) walk you through this i
 brew install chezmoi age duckdb
 ```
 
+Reference docs for the moving parts: [chezmoi](https://www.chezmoi.io) ([quick start](https://www.chezmoi.io/quick-start/)), [age](https://github.com/FiloSottile/age), [DuckDB](https://duckdb.org/).
+
 You need git access to whichever forge you'll host the fleet repo on (gitea, GitHub, forgejo, gitlab — anything chezmoi can clone over HTTPS or SSH).
 
 ## 1. Fork this template