feat: run.sh entry point and Tahoe manual checklist

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/run.sh

@@ -0,0 +1,18 @@
+#!/bin/bash
+# From steel141: sync repo to the Mac, run setup there, pull backups back, then do the tank side.
+# Usage: scripts/run.sh [--no-tank]
+# sudo on the Mac is primed from $HOMELAB_PASSWORD over a forced pty (ssh -tt) so this works from a
+# non-interactive session; with the var unset it falls back to an interactive prompt.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+rsync -a --delete --exclude .git --exclude .backup --exclude Brewfile.lock.json ./ mac:mac/
+if [[ -n ${HOMELAB_PASSWORD:-} ]]; then
+  printf '%s\n' "$HOMELAB_PASSWORD" | ssh -tt mac 'sudo -S -v && HOSTNAME_WANT=mac ~/mac/scripts/setup.sh; exit' | tr -d '\r'
+else
+  ssh -t mac 'HOSTNAME_WANT=mac ~/mac/scripts/setup.sh'
+fi
+mkdir -p .backup/mac && rsync -a mac:.mac-setup-backup/ .backup/mac/
+[[ ${1:-} == --no-tank ]] && exit 0
+PUB=$(ssh mac cat .ssh/id_ed25519.pub)
+ssh pve173 'bash -s' -- "$PUB" < scripts/tank-side.sh
+echo "tank side done; test: ssh mac ~/mac/scripts/backup.sh"