Initial ssr repository

Convert the legacy system_sync.sh and system_restore.sh into a modular
shareable repository:

- bin/ssr CLI dispatcher with install/sync/restore/schedule/config/status
- lib/ split: common, cloud, brew, mackup, macos
- Cloud provider abstraction (icloud, dropbox, googledrive, onedrive, custom)
- launchd template for scheduled daily sync (renderable via sed)
- ssr.conf.example with whitelisted KEY=VALUE config loader
- macos-defaults.sh extracted from inline block, overridable
- install.sh bootstrap symlinks CLI into ~/.local/bin
- README with usage, config table, migration map, security notes
- Original scripts archived under legacy/ for reference

Fixes vs originals: set -euo pipefail, quoted vars, find -print0,
spctl --global-disable (was --master-disable), MACOS=".macos" bug,
zero-width char before ln, Apple Silicon brew shellenv, config injection
hardening.

Co-authored-by: Cursor <cursoragent@cursor.com>

bin/ssr-restore

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# ssr-restore — restore brew packages, mackup data, macOS defaults.
+
+set -euo pipefail
+SSR_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck source=../lib/common.sh
+source "$SSR_ROOT/lib/common.sh"
+# shellcheck source=../lib/cloud.sh
+source "$SSR_ROOT/lib/cloud.sh"
+# shellcheck source=../lib/brew.sh
+source "$SSR_ROOT/lib/brew.sh"
+# shellcheck source=../lib/mackup.sh
+source "$SSR_ROOT/lib/mackup.sh"
+# shellcheck source=../lib/macos.sh
+source "$SSR_ROOT/lib/macos.sh"
+
+ssr::require_macos
+ssr::load_config
+
+usage() {
+    cat <<EOF
+Usage: ssr restore [BREWFILE]
+
+If BREWFILE is omitted, the latest cloud backup is used:
+  <cloud>/BACKUP/<host> - <uuid>/Brewfile
+EOF
+}
+
+[[ "${1:-}" == "-h" || "${1:-}" == "--help" ]] && { usage; exit 0; }
+
+ssr::log "ssr restore starting"
+ssr::cloud::ensure_available
+backup_dir="$(ssr::cloud::backup_dir)"
+mackup_dir="$(ssr::cloud::mackup_dir)"
+
+brewfile="${1:-$backup_dir/Brewfile}"
+[[ -f "$brewfile" ]] || ssr::die "Brewfile not found: $brewfile"
+ssr::log "Using Brewfile: $brewfile"
+
+ssr::confirm "Configure iCloud / cloud drive and proceed with restore?" 60 \
+    || ssr::die "Aborted by user"
+
+ssr::macos::disable_gatekeeper
+ssr::macos::install_rosetta
+
+ssr::brew::ensure_installed
+ssr::brew::update
+ssr::brew::restore "$brewfile"
+
+ssr::mackup::ensure_installed
+ssr::mackup::configure "$mackup_dir"
+ssr::mackup::restore
+
+ssr::macos::open_installed_casks
+ssr::macos::apply_defaults
+
+ssr::ok "ssr restore completed"