Share definitions via lib.sh, fold Launch Clipy into login items

[jpmontez]

bootstrap.sh and doctor.sh each carried their own copy of the stow package list, the Brewfile tier logic, the .machine read, and the platform check. Nothing kept them in sync: adding a stow package meant editing two lists, and doctor.sh's ssh --no-folding was a bare literal that had to match bootstrap.sh's by hand. All of it moves into lib.sh — DOTFILES_DIR, PLATFORM, STOW_PACKAGES, SSH_STOW_OPTS, and helpers for loading/saving the machine tier and resolving in-scope Brewfiles. The file only defines; sourcing it runs nothing.

Launch Clipy was built and registered as a login item by build-launch-clipy.sh, outside LOGIN_ITEM_APPS, so --check never covered it. The applet is now a LOGIN_ITEM_APPS row, built by defaults.sh just before the login-item pass. Its own existence can't ride on that row — process_login_items skips apps that aren't present, so an unbuilt applet is indistinguishable from an uninstalled one — hence build-launch-clipy.sh --check, exiting 0 built / 1 missing / 3 n/a when Clipy or the Automator stub is absent.

CI listed its lint targets by hand, so a new script could ship unlinted. Targets now come from git ls-files for shellcheck, zsh -n, the Brewfiles, and plutil.

Smaller cleanups

• FileVault was reported by both defaults.sh and doctor.sh. Dropped the defaults.sh copy; drift reporting belongs in doctor.sh, and the README now says so.
• bootstrap.sh's read/[[ =~ ]] prompt pairs become confirm() and interactive(), deciding the --yes and no-tty cases in one place.
• --help was sed -n '2,10p' of the script's own header, silently wrong the moment a line moved. Now a usage() heredoc.
• Added doctor.sh's detail() for the four places that indented captured output line by line.
• Dropped bootstrap.sh's trailing ~/.zshrc check: readlink -f against a glob inside [[ ]] is a literal comparison that never matched, and the stow section already reports this.
• Replaced basename with parameter expansion in the login-item and Dock paths, and compare Dock names without grep so an app name containing regex metacharacters can't misreport.

Verification

• git ls-files '*.sh' | xargs shellcheck — clean
• bash -n on every tracked script — clean
• lib.sh sources cleanly; helpers resolve PLATFORM=macos, tier core only, one in-scope Brewfile

🤖 Generated with Claude Code

https://claude.ai/code/session_01AY9x8Cs9gZTgMMRfsW23ay