Initial ssr repository

Convert the legacy system_sync.sh and system_restore.sh into a modular
shareable repository:

- bin/ssr CLI dispatcher with install/sync/restore/schedule/config/status
- lib/ split: common, cloud, brew, mackup, macos
- Cloud provider abstraction (icloud, dropbox, googledrive, onedrive, custom)
- launchd template for scheduled daily sync (renderable via sed)
- ssr.conf.example with whitelisted KEY=VALUE config loader
- macos-defaults.sh extracted from inline block, overridable
- install.sh bootstrap symlinks CLI into ~/.local/bin
- README with usage, config table, migration map, security notes
- Original scripts archived under legacy/ for reference

Fixes vs originals: set -euo pipefail, quoted vars, find -print0,
spctl --global-disable (was --master-disable), MACOS=".macos" bug,
zero-width char before ln, Apple Silicon brew shellenv, config injection
hardening.

Co-authored-by: Cursor <cursoragent@cursor.com>

config/macos-defaults.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# macos-defaults.sh — opinionated macOS preferences applied during restore.
+# Override by setting SSR_MACOS_DEFAULTS in your config to your own script.
+# Each block is independent; failures are logged but do not abort the script.
+
+set -uo pipefail
+
+run() {
+    if ! "$@"; then
+        printf '[macos-defaults] failed: %s\n' "$*" >&2
+    fi
+}
+
+# Dock: position + appearance
+run defaults write com.apple.dock pinning -string middle
+run defaults write com.apple.dock mouse-over-hilte-stack -bool true
+
+# Dock: recent applications stack
+run defaults write com.apple.dock persistent-others -array-add \
+    '{ "tile-data" = { "list-type" = 1; }; "tile-type" = "recents-tile"; }'
+
+# Login window message (requires sudo; skipped without)
+if sudo -n true 2>/dev/null; then
+    run sudo defaults write /Library/Preferences/com.apple.loginwindow LoginwindowText "Welcome back..."
+fi
+
+# Time Machine on unsupported network volumes
+run defaults write com.apple.systempreferences TMShowUnsupportedNetworkVolumes -bool true
+
+# Mail: prefer plain text
+run defaults write com.apple.mail PreferPlainText -bool true
+
+# Finder: show hidden files + path bar
+run defaults write com.apple.finder AppleShowAllFiles -bool true
+run defaults write com.apple.finder ShowPathbar -bool true
+
+# Screenshots: save to ~/Pictures/Screenshots as PNG
+mkdir -p "$HOME/Pictures/Screenshots"
+run defaults write com.apple.screencapture location -string "$HOME/Pictures/Screenshots"
+run defaults write com.apple.screencapture type -string png
+
+# Reload affected services
+killall Dock 2>/dev/null || true
+killall Finder 2>/dev/null || true
+killall SystemUIServer 2>/dev/null || true

config/ssr.conf.example

@@ -0,0 +1,49 @@
+# ssr.conf — System Sync & Restore configuration.
+# Format: simple KEY=VALUE pairs. Comments (# …) and blank lines allowed.
+# This file is sourced by bash; only the keys below are recognized.
+# Anything else will cause ssr to abort.
+
+# ---------------------------------------------------------------------------
+# Cloud storage
+# ---------------------------------------------------------------------------
+# Provider: icloud | dropbox | googledrive | onedrive | custom
+SSR_CLOUD_PROVIDER=icloud
+
+# Only used when SSR_CLOUD_PROVIDER=custom. Absolute path.
+# SSR_CLOUD_PATH=/Volumes/MyNAS/macos-sync
+
+# Subfolders created inside the cloud root.
+SSR_BACKUP_SUBDIR=BACKUP
+SSR_MACKUP_SUBDIR=Mackup
+
+# ---------------------------------------------------------------------------
+# Homebrew behavior during `ssr sync`
+# ---------------------------------------------------------------------------
+SSR_BREW_UPGRADE=true
+SSR_BREW_CLEANUP=true
+
+# ---------------------------------------------------------------------------
+# macOS restore behavior
+# ---------------------------------------------------------------------------
+# Disabling Gatekeeper allows apps from anywhere. Off by default.
+SSR_DISABLE_GATEKEEPER=false
+
+# Open every installed cask once after restore (for first-run config).
+SSR_OPEN_CASKS=false
+
+# Path to the macOS defaults script applied at the end of `ssr restore`.
+# Leave commented to use the repo default (config/macos-defaults.sh).
+# SSR_MACOS_DEFAULTS=/path/to/your/macos-defaults.sh
+
+# ---------------------------------------------------------------------------
+# Scheduling
+# ---------------------------------------------------------------------------
+SSR_LAUNCHD_LABEL=de.surke.ssr.sync
+SSR_SCHEDULE_HOUR=9
+SSR_SCHEDULE_MINUTE=0
+
+# ---------------------------------------------------------------------------
+# Paths
+# ---------------------------------------------------------------------------
+# SSR_STATE_DIR=$HOME/.local/state/ssr
+# SSR_LOG_DIR=$HOME/.local/state/ssr/logs