feat: restore state/resume/report + single Spotlight index after mas installs

lib/brew.sh:
  Set MAS_NO_AUTO_INDEX=1 before brew bundle install to suppress the
  per-app mdimport call that mas otherwise runs after each App Store
  installation. Run one mdimport /Applications batch pass afterwards.

lib/restore-state.sh (new):
  Lightweight key=value state file (~/.local/state/ssr/restore-state).
  ssr::rs::init / ssr::rs::run / ssr::rs::set/get / ssr::rs::error /
  ssr::rs::report — tracks step outcomes and accumulated errors.

bin/ssr-restore:
  --resume flag: skip steps already marked ok in state file.
  Each step (brew_install, brew_restore, mackup_restore, macos_defaults,
  prefs_import) wrapped in ssr::rs::run; errors accumulate without abort.
  Formatted report printed at end of every run.

bin/ssr-status:
  ssr status restore — full restore step report + error log
  ssr status backup  — Brewfile lines, unmanaged apps, prefs snapshot
  ssr status         — general view now shows one-line last-restore
                       summary and hint to run 'ssr status restore'

Co-authored-by: Cursor <cursoragent@cursor.com>

bin/ssr-restore

@@ -1,5 +1,9 @@
 #!/usr/bin/env bash
 # ssr-restore — restore brew packages, mackup data, macOS defaults.
+#
+# Flags:
+#   --resume   Skip steps already marked 'ok' in the previous run's state.
+#   -h|--help  Show usage.
 
 set -euo pipefail
 SSR_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
@@ -15,24 +19,42 @@ source "$SSR_ROOT/lib/mackup.sh"
 source "$SSR_ROOT/lib/macos.sh"
 # shellcheck source=../lib/macos-prefs.sh
 source "$SSR_ROOT/lib/macos-prefs.sh"
+# shellcheck source=../lib/restore-state.sh
+source "$SSR_ROOT/lib/restore-state.sh"
 
 ssr::require_macos
 ssr::load_config
 
 usage() {
     cat <<EOF
-Usage: ssr restore [BREWFILE]
+Usage: ssr restore [--resume] [BREWFILE]
+
+Restores Homebrew packages, Mackup dotfiles and macOS settings.
+
+  --resume   Skip steps already completed in a previous (aborted) run.
+             State is read from: \$SSR_STATE_DIR/restore-state
 
 If BREWFILE is omitted, the latest cloud backup is used:
   <cloud>/BACKUP/<host> - <uuid>/Brewfile
 EOF
 }
 
-[[ "${1:-}" == "-h" || "${1:-}" == "--help" ]] && { usage; exit 0; }
+# --- Argument parsing --------------------------------------------------------
+SSR_RESTORE_RESUME=false
+BREWFILE_ARG=""
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --resume)   SSR_RESTORE_RESUME=true; shift ;;
+        -h|--help)  usage; exit 0 ;;
+        -*)         ssr::die "Unknown flag: $1" ;;
+        *)          BREWFILE_ARG="$1"; shift ;;
+    esac
+done
+export SSR_RESTORE_RESUME
 
-ssr::log "ssr restore starting"
+# --- Cloud + Brewfile --------------------------------------------------------
+ssr::log "ssr restore starting${SSR_RESTORE_RESUME:+ (--resume mode)}"
 
-# Resolve cloud dir early so we can check availability before prompting.
 _cloud_dir="$(ssr::cloud::resolve_dir 2>/dev/null)" || true
 if [[ -z "$_cloud_dir" || ! -d "$_cloud_dir" ]]; then
     ssr::warn "Cloud directory not yet accessible: ${_cloud_dir:-<unknown>}"
@@ -45,28 +67,44 @@ ssr::cloud::ensure_available
 backup_dir="$(ssr::cloud::backup_dir)"
 mackup_dir="$(ssr::cloud::mackup_dir)"
 
-brewfile="${1:-$backup_dir/Brewfile}"
+brewfile="${BREWFILE_ARG:-$backup_dir/Brewfile}"
 [[ -f "$brewfile" ]] || ssr::die "Brewfile not found: $brewfile"
 ssr::log "Using Brewfile: $brewfile"
 
-ssr::macos::disable_gatekeeper
-ssr::macos::install_rosetta
+# Initialise state (archives previous state file if present).
+ssr::rs::init "$brewfile"
 
-ssr::brew::ensure_installed
-ssr::brew::update
-ssr::brew::restore "$brewfile"
+# --- Step helpers ------------------------------------------------------------
 
-ssr::mackup::ensure_installed
-ssr::mackup::configure "$mackup_dir"
-ssr::mackup::restore
+# Groups mackup install + configure + restore into a single resumable step.
+_ssr_mackup_restore_step() {
+    ssr::mackup::ensure_installed
+    ssr::mackup::configure "$mackup_dir"
+    ssr::mackup::restore
+}
 
-ssr::macos::open_installed_casks
-ssr::macos::apply_defaults
+# --- Steps -------------------------------------------------------------------
+
+ssr::rs::run brew_install    "Homebrew install"        ssr::brew::ensure_installed
+ssr::rs::run brew_restore    "Brew bundle install"     ssr::brew::restore "$brewfile"
+ssr::rs::run mackup_restore  "Mackup restore"          _ssr_mackup_restore_step
+
+ssr::rs::run macos_defaults  "macOS defaults"          ssr::macos::apply_defaults
 
-# Import the macOS pref snapshot AFTER the declarative defaults so the
-# snapshot is the last writer (wins for accepted domains).
 if [[ "${SSR_SNAPSHOT_MACOS_PREFS:-true}" == "true" ]]; then
-    ssr::macos::prefs_import "$backup_dir"
+    ssr::rs::run prefs_import "Prefs snapshot import"  ssr::macos::prefs_import "$backup_dir"
+else
+    ssr::rs::set "step_prefs_import" "skipped"
 fi
 
+# Optional: open installed cask apps for first-run config (not tracked as a
+# resumable step — it's side-effect-only and always safe to re-run).
+ssr::macos::open_installed_casks
+
+# Mark overall completion time.
+ssr::rs::set "finished" "$(ssr::ts)"
+
+# --- Final report ------------------------------------------------------------
+ssr::rs::report
+
 ssr::ok "ssr restore completed"