feat(tank): autofs SMB mount of tank at /Volumes/tank

scripts/tank-automount.sh (run on the Mac, password on stdin) adds a /-
direct map and root-owned /etc/auto_smb pointing at //Administrator@
192.168.0.173/tank with soft. Mounts on first access, unmounts idle, so
the laptop can leave the LAN without hung Finder or login dialogs.

Findings baked in:
- macOS automount does not create direct-map trigger dirs -> mkdir -p
- automounted fs are always nobrowse (man auto_master): shows as a
  folder, not a Locations drive -> Finder Favorite (manual-checklist)
- no-tty sudo ticket is per parent pid: sudo inside $(...) fails, so the
  idempotency check is a pipeline (sudo cmp -s -)
- SMB over NFS: Mac seth is uid 501; SMB force user=root matches /mnt/Z

Also: checklist Gitea key -> id_ed25519_homelab; the smb://.../tank
'user seth' step was wrong (no such Samba user) and is now the automount.
Wired into run.sh. Verified: mount, root-owned write, two all-[skip] reruns.
Not yet verified across a reboot (FileVault).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -34,6 +34,7 @@ laptop" shape).
 - Backup: `~/Music/Ableton` + `~/Documents` -> `pve173:/tank/backups/mac` nightly
   03:30 via launchd; key is rrsync-jailed; sanoid keeps history (tank_media template).
 - ssh aliases (`config/ssh_homelab`, included from `~/.ssh/config`) mirror the `~/bin/CLAUDE.md` set. Two keys: `id_ed25519` = backup (rrsync-jailed on pve173), `id_ed25519_homelab` = interactive. `scripts/authorize-mac-key.sh` (from steel141) pushes the interactive key; re-run it when an offline host comes back.
+- tank: autofs SMB at `/Volumes/tank` (`scripts/tank-automount.sh`, password on stdin). Mounts on access, `nobrowse` by macOS design → a Finder Favorite, not a Locations drive. Not yet verified across a reboot.
 - SparkFun PPP service left in place (macOS won't remove the sole service on a port; harmless).
 
 ## Conventions