Fix ssr::confirm using bash 4+ lowercase operator on bash 3.2

macOS ships /bin/bash 3.2.57 which has no `${var,,}` parameter expansion.
Replace with a portable case statement matching y/Y. Behaviorally
identical (read -n 1 already constrains input to a single char, and the
original code only accepted 'y' after lowercasing, so 'y' and 'Y' are
the only accepting inputs).

Repo-wide audit for other bash 4+ features (case modification, mapfile,
nameref locals, ${var@op} transforms, coproc) returned clean.

Repro before fix:
  $ ./install.sh
  Enable daily scheduled sync (launchd)? [y/N]: y
  lib/common.sh: line 52: ${reply,,}: bad substitution

Co-authored-by: Cursor <cursoragent@cursor.com>

lib/common.sh

@@ -49,7 +49,7 @@ ssr::confirm() {
         read -r -n 1 -p "${prompt} [y/N]: " reply || reply=""
     fi
     echo
-    [[ "${reply,,}" == "y" ]]
+    case "$reply" in y|Y) return 0 ;; *) return 1 ;; esac
 }
 
 # Validate a path is safe (no newlines, no `..` traversal). Used before any FS op.