Snapshot and restore macOS preference domains

Adds a round-trip mechanism for macOS system preferences that are not
covered by Homebrew or Mackup (Dock layout, Finder options, global
keyboard shortcuts, input sources, Spaces config, menu-bar clock,
NSGlobalDomain).

sync: `ssr sync` exports each configured domain with `defaults export`
and writes one plist per domain to <backup_dir>/macos-prefs/.  Export is
soft-fail per domain so one bad domain doesn't abort the sync. Gated by
SSR_SNAPSHOT_MACOS_PREFS=true (default on).

restore: `ssr restore` replays the snapshot with `defaults import` after
the declarative config/macos-defaults.sh runs, so the snapshot is the
last writer and wins for accepted domains.  Before importing, the restore
detects domains that both the snapshot and macos-defaults.sh touch and
prompts interactively:

  Domain `com.apple.dock`:
    Snapshot will OVERRIDE values set by macos-defaults.sh.
    [A]ccept snapshot / [r]eject (keep declarative)? [A/r]:

Non-TTY (launchd, CI) falls back to SSR_PREFS_CONFLICT_DEFAULT (default
"accept"). SSR_ASSUME_YES=true skips all prompts. After import, Dock,
Finder, SystemUIServer and cfprefsd are restarted once.

New config keys: SSR_SNAPSHOT_MACOS_PREFS, SSR_MACOS_PREF_DOMAINS,
SSR_MACOS_PREF_DOMAINS_EXTRA, SSR_PREFS_CONFLICT_DEFAULT, SSR_ASSUME_YES.

ssr-status surfaces the snapshotted-domain count.
README documents the snapshot flow, default domain table, conflict UX,
and the five new config keys.

Co-authored-by: Cursor <cursoragent@cursor.com>

bin/ssr-restore

@@ -13,6 +13,8 @@ source "$SSR_ROOT/lib/brew.sh"
 source "$SSR_ROOT/lib/mackup.sh"
 # shellcheck source=../lib/macos.sh
 source "$SSR_ROOT/lib/macos.sh"
+# shellcheck source=../lib/macos-prefs.sh
+source "$SSR_ROOT/lib/macos-prefs.sh"
 
 ssr::require_macos
 ssr::load_config
@@ -54,4 +56,10 @@ ssr::mackup::restore
 ssr::macos::open_installed_casks
 ssr::macos::apply_defaults
 
+# Import the macOS pref snapshot AFTER the declarative defaults so the
+# snapshot is the last writer (wins for accepted domains).
+if [[ "${SSR_SNAPSHOT_MACOS_PREFS:-true}" == "true" ]]; then
+    ssr::macos::prefs_import "$backup_dir"
+fi
+
 ssr::ok "ssr restore completed"