feat(tank): autofs SMB mount of tank at /Volumes/tank

scripts/tank-automount.sh (run on the Mac, password on stdin) adds a /-
direct map and root-owned /etc/auto_smb pointing at //Administrator@
192.168.0.173/tank with soft. Mounts on first access, unmounts idle, so
the laptop can leave the LAN without hung Finder or login dialogs.

Findings baked in:
- macOS automount does not create direct-map trigger dirs -> mkdir -p
- automounted fs are always nobrowse (man auto_master): shows as a
  folder, not a Locations drive -> Finder Favorite (manual-checklist)
- no-tty sudo ticket is per parent pid: sudo inside $(...) fails, so the
  idempotency check is a pipeline (sudo cmp -s -)
- SMB over NFS: Mac seth is uid 501; SMB force user=root matches /mnt/Z

Also: checklist Gitea key -> id_ed25519_homelab; the smb://.../tank
'user seth' step was wrong (no such Samba user) and is now the automount.
Wired into run.sh. Verified: mount, root-owned write, two all-[skip] reruns.
Not yet verified across a reboot (FileVault).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/run.sh

@@ -22,6 +22,9 @@ printf '%s\n' "$HOMELAB_PASSWORD" | ssh -o BatchMode=yes mac 'bash ~/mac/scripts
 # sudo is now passwordless on the Mac; run setup unattended (Homebrew + everything).
 ssh -o BatchMode=yes mac "HOSTNAME_WANT=mac ~/mac/scripts/setup.sh"
 
+# tank autofs mount (reads the password on stdin: SMB credential + its own sudo -S).
+printf '%s\n' "$HOMELAB_PASSWORD" | ssh -o BatchMode=yes mac 'bash ~/mac/scripts/tank-automount.sh'
+
 # Explicit removal + confirm; then disarm the trap so it doesn't double-run.
 cleanup; trap - EXIT
 ssh -o BatchMode=yes mac 'test ! -e /etc/sudoers.d/mac-setup && echo "[ok] temp sudoers removed" || echo "[WARN] temp sudoers STILL PRESENT"'

scripts/tank-automount.sh

@@ -0,0 +1,34 @@
+#!/opt/homebrew/bin/bash
+# tank-automount.sh — run ON the Mac as seth. From steel141:
+#   printf '%s\n' "$HOMELAB_PASSWORD" | ssh mac 'bash ~/mac/scripts/tank-automount.sh'
+# tank at /Volumes/tank via autofs + SMB, as Administrator (= root on tank, same as steel141's
+# /mnt/Z). autofs mounts on first access and unmounts when idle, so a laptop that leaves the LAN
+# gets no login-time "server not found" dialogs and no hung Finder. Password lives ONLY in
+# root-owned /etc/auto_smb (0600); it is also seth's sudo password here, so stdin serves both.
+# Known limit: automounted fs are always `nobrowse` -> not a drive in Finder's Locations sidebar.
+# It's a folder: drag /Volumes/tank to Finder Favorites once (docs/manual-checklist.md).
+set -euo pipefail
+IFS= read -r PW; [[ -n $PW ]] || { echo "password expected on stdin"; exit 1; }
+BK="$HOME/.mac-setup-backup"; TS=$(date +%s); mkdir -p "$BK"
+log(){ printf '\033[1;33m[%s]\033[0m %s\n' "$1" "$2"; }
+printf '%s\n' "$PW" | sudo -S -p '' -v            # one ticket for the run; -K at the end
+trap 'sudo -K' EXIT
+
+if grep -qE '^/-[[:space:]]+auto_smb' /etc/auto_master; then log skip "auto_master direct map"; else
+  sudo cp /etc/auto_master "$BK/auto_master-$TS"
+  printf '/-\t\t\tauto_smb\t-nosuid\n' | sudo tee -a /etc/auto_master >/dev/null; log set "auto_master += auto_smb"
+fi
+
+# password via stdin (never argv) -> %-encoded for the URL
+ENC=$(printf '%s' "$PW" | python3 -c 'import sys,urllib.parse;print(urllib.parse.quote(sys.stdin.read(),safe=""))')
+MAP="/Volumes/tank	-fstype=smbfs,soft	://Administrator:${ENC}@192.168.0.173/tank"
+# pipeline, not $(sudo cat): the no-tty sudo ticket is per parent pid and a subshell breaks it
+if printf '%s\n' "$MAP" | sudo cmp -s - /etc/auto_smb 2>/dev/null; then log skip "/etc/auto_smb"; else
+  printf '%s\n' "$MAP" | sudo tee /etc/auto_smb >/dev/null   # no backup: it's ours and holds the password
+  sudo chmod 600 /etc/auto_smb; sudo chown root:wheel /etc/auto_smb; log set "/etc/auto_smb"
+fi
+
+sudo mkdir -p /Volumes/tank   # automount won't create direct-map triggers ("mountpoint unavailable"); a plain dir here persists
+sudo automount -vc >/dev/null
+if ls /Volumes/tank >/dev/null 2>&1 && mount | grep -q ' /Volumes/tank (smbfs'; then log ok "tank mounted: $(mount | grep ' /Volumes/tank (smbfs' | cut -d' ' -f1)"
+else log warn "trigger present but mount failed — off the LAN, or bad SMB credentials? (check: log show --last 2m --predicate 'process == \"automountd\"')"; fi