Initial ssr repository

Convert the legacy system_sync.sh and system_restore.sh into a modular
shareable repository:

- bin/ssr CLI dispatcher with install/sync/restore/schedule/config/status
- lib/ split: common, cloud, brew, mackup, macos
- Cloud provider abstraction (icloud, dropbox, googledrive, onedrive, custom)
- launchd template for scheduled daily sync (renderable via sed)
- ssr.conf.example with whitelisted KEY=VALUE config loader
- macos-defaults.sh extracted from inline block, overridable
- install.sh bootstrap symlinks CLI into ~/.local/bin
- README with usage, config table, migration map, security notes
- Original scripts archived under legacy/ for reference

Fixes vs originals: set -euo pipefail, quoted vars, find -print0,
spctl --global-disable (was --master-disable), MACOS=".macos" bug,
zero-width char before ln, Apple Silicon brew shellenv, config injection
hardening.

Co-authored-by: Cursor <cursoragent@cursor.com>

lib/macos.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# lib/macos.sh — macOS system preferences.
+# Sourced by `ssr restore`. Each setting is idempotent.
+
+ssr::macos::apply_defaults() {
+    local script="${1:-${SSR_MACOS_DEFAULTS:-$SSR_ROOT/config/macos-defaults.sh}}"
+    if [[ ! -f "$script" ]]; then
+        ssr::warn "macOS defaults script missing: $script (skipping)"
+        return 0
+    fi
+    ssr::log "Applying macOS defaults from $script"
+    # shellcheck disable=SC1090
+    bash "$script"
+    ssr::ok "macOS defaults applied"
+}
+
+ssr::macos::install_rosetta() {
+    if /usr/bin/arch -x86_64 /usr/bin/true >/dev/null 2>&1; then
+        return 0
+    fi
+    if [[ "$(uname -m)" != "arm64" ]]; then
+        return 0
+    fi
+    ssr::log "Installing Rosetta 2"
+    sudo softwareupdate --install-rosetta --agree-to-license
+}
+
+# Allows non-App-Store apps to run. Requires sudo. Skipped unless explicitly
+# enabled, because disabling Gatekeeper has security implications.
+ssr::macos::disable_gatekeeper() {
+    [[ "${SSR_DISABLE_GATEKEEPER:-false}" == "true" ]] || return 0
+    ssr::warn "Disabling Gatekeeper (SSR_DISABLE_GATEKEEPER=true)"
+    sudo spctl --global-disable
+}
+
+ssr::macos::open_installed_casks() {
+    [[ "${SSR_OPEN_CASKS:-false}" == "true" ]] || return 0
+    local cask_dir
+    cask_dir="$(brew --caskroom 2>/dev/null)" || return 0
+    [[ -d "$cask_dir" ]] || return 0
+    ssr::log "Opening installed cask apps for first-run config"
+    find "$cask_dir" -maxdepth 3 -iname '*.app' -print0 \
+        | while IFS= read -r -d '' app; do
+            open "$app" || true
+        done
+}