blog: restore SSH/KVM HID approval post (USB restricted-mode polarity fixed)

[Jesssullivan]

Restores the post reverted in e0bbf57, with the load-bearing correction ratified 2026-07-14:

• allowUSBRestrictedMode is now written -bool false (was true). The key name is inverted from the intent: false disables accessory authorization so the KVM/HID can enumerate without a console click.
• The cleanup remains defaults delete, which removes the one-off override and restores the default or managed policy.
• Durable policy is described accurately as a device-level com.apple.applicationaccess Restrictions profile, normally delivered by MDM. The defaults write path is explicitly an empirically verified one-off escape hatch, not fleet enforcement.
• The post records the availability/security tradeoff for load-bearing USB devices such as external build SSDs and YubiKeys.

Operator checks before merge:

1. Re-test lock/reconnect behavior on the intended hardware; Apple documents the managed restriction broadly but its accessory-security behavior specifically for Apple-silicon laptops.
2. Merging adds a post to spoke main, so sequence the managed-blog import/parity update deliberately.

HELD FOR REVIEW. Do not merge without explicit operator approval.

[github-actions]

📝 Blog Post Review

Found 1 blog post(s) in this PR:

Post	Status	Date	Published	Tags	Linear
The tiny SSH trick for letting a USB KVM talk to a locked Mac	🆕 New	2026-06-23	✅ Published	macOS, hardware, homelab, usb-protocol, kvm, ssh	none

Schema Validation

✅ All posts pass schema validation.

Slash Commands

Command	Description
/schedule 2026-03-15	Schedule auto-merge for a date
/publish	Set all posts to published: true
/draft	Set all posts back to draft
/retitle "New Title"	Change a post's title
/review	Re-run AI prose review
/suggest-links	Find unlinked keywords

[Jesssullivan]

Status: gates GREEN, held for operator review (content-publication rule).

Post-#228 bazel-remote-gates rerun passed. This PR stays unmerged until the operator reviews the restored post per the no-auto-publish rule — content publication needs per-item confirmation. On merge, the tinyland.dev managed-import parity step follows (pnpm run import:jesssullivan-blog-posts --write + staged single-file PR), or every tinyland.dev PR goes red on the managed-mirror parity gate.