feat(tank): autofs SMB mount of tank at /Volumes/tank

scripts/tank-automount.sh (run on the Mac, password on stdin) adds a /-
direct map and root-owned /etc/auto_smb pointing at //Administrator@
192.168.0.173/tank with soft. Mounts on first access, unmounts idle, so
the laptop can leave the LAN without hung Finder or login dialogs.

Findings baked in:
- macOS automount does not create direct-map trigger dirs -> mkdir -p
- automounted fs are always nobrowse (man auto_master): shows as a
  folder, not a Locations drive -> Finder Favorite (manual-checklist)
- no-tty sudo ticket is per parent pid: sudo inside $(...) fails, so the
  idempotency check is a pipeline (sudo cmp -s -)
- SMB over NFS: Mac seth is uid 501; SMB force user=root matches /mnt/Z

Also: checklist Gitea key -> id_ed25519_homelab; the smb://.../tank
'user seth' step was wrong (no such Samba user) and is now the automount.
Wired into run.sh. Verified: mount, root-owned write, two all-[skip] reruns.
Not yet verified across a reboot (FileVault).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

DECISIONS.md

@@ -21,6 +21,7 @@ Format: `YYYY-MM-DD: <decision> — <why>`
 - 2026-09-15: **Optional/cosmetic steps must be non-fatal under `set -e`.** The SparkFun removal (macOS refuses) and the GUI-domain `launchctl bootstrap` (flaky over SSH) both aborted the run until guarded with `|| warn`. Rule for this repo: anything that can legitimately fail without breaking the goal gets a best-effort guard.
 - 2026-09-15: **Two ssh keys on the Mac: `id_ed25519` (backup, rrsync-jailed) + `id_ed25519_homelab` (interactive, `Host *` default).** sshd honours the first matching authorized_keys line per key, so one key can't be both jailed and a shell on pve173. `backup.sh` pins the jailed key with `-i` + `IdentitiesOnly`; verify with `id`, not `true` (rrsync whitelists `true` as a ping). Key push = `scripts/authorize-mac-key.sh` from steel141 (uses claude's aliases; pve nodes share `/etc/pve/priv/authorized_keys`, so one write covers all four).
 - 2026-09-15: Mac ssh aliases mirror the curated set in `~/bin/CLAUDE.md` (not claude's full `~/.ssh/config`) — stale/undocumented entries (nixos, thinkpad-nano, mortdec-auth, vast) left out. `bedroom` = root, matching steel141's alias (was `seth`, undocumented).
+- 2026-09-15: **tank on the Mac = autofs + SMB (`Administrator`, = root on tank) at `/Volumes/tank`, via `scripts/tank-automount.sh`** — mounts on access, unmounts idle, `soft`: a laptop that leaves the LAN gets no hung Finder and no login-time "server unavailable" dialogs (same idea as vdj-rig's `x-systemd.automount`). SMB over NFS because the Mac's seth is uid 501: NFS would write as an unknown uid and only into the 777 dirs; SMB `force user = root` matches steel141's `/mnt/Z`. Cost: the password sits in root-owned `/etc/auto_smb` (0600) — same class as steel141's `~/.smbcredentials`. `automount` does not create direct-map trigger dirs, so the script `mkdir -p`s it. sudo inside `$(...)` loses the no-tty ticket — keep sudo in pipelines/direct calls.
 - 2026-09-15: `defaults displaysleep` on AC = 30 min, not 0 — display sleep doesn't stop Live's audio; only system `sleep` does.
 
 ## Deferred / Rejected
@@ -29,4 +30,5 @@ Format: `YYYY-MM-DD: <decision> — <why>`
 - 2026-09-15: yabai REJECTED — useful features need partial SIP disable. SIP/Gatekeeper/FileVault all stay on.
 - 2026-09-15: Time Machine REJECTED — over SMB it's fragile and whole-disk; rsync + tank-side ZFS snapshot covers the actual need.
 - 2026-09-15: Removing `/System/Applications` apps REJECTED — sealed system volume; hide from Dock instead.
+- 2026-09-15: Finder "Connect to Server" + Login Item for tank REJECTED (for now) — it's the only way to get a real drive icon under Locations, but it hard-mounts: off-LAN logins throw a server dialog and a dropped network beachballs Finder for ~60 s. autofs mounts are always `nobrowse` (`man auto_master`), so the trade is drive-icon vs roaming-safe; roaming-safe won. Revisit if Seth wants the icon.
 - 2026-09-15: Samples/projects on the SMB share REJECTED — local disk only; SMB is a copy source. External SSD is the capacity upgrade path.