feat(macos): qualify the Tahoe Lume seed and its Mac Studio host

[jmgilman]

Summary

The macOS backend's image side, built and gated on real hardware.
images/macos/:

• pins.lock.yaml — Lume 0.5.3, Cua Driver 0.28.1 (darwin-arm64), and both the
  Tahoe and Sequoia IPSWs. Every digest was measured on the host and matched.
• provision.sh, verify.sh, lib.sh — shared by every train; per-train
  directories hold only image.yaml and unattended.yaml.
• tahoe/desktop/ — the qualified train. sequoia/desktop/ stays recorded.
• README.md — operator runbook, measurements, findings.
• images-validate.yml parses the scripts and asserts every pin they read.

Host: studio-1 (Mac Studio M2 Max, macOS 26.6.2), the owner's amendment to
design prerequisite 5 — an always-on workstation rather than a dedicated Mac
mini, with the backend confined to a dedicated agentcompute account.
Migration to a mini is moving that account's ~/.lume and re-issuing one key.

Evidence

Four clone cycles: clone 2–3 s, boot to NAT address 10–11 s, Driver
answering with both TCC grants ~30 s, verify.sh 6–7 s, ~26.5 GB
allocated per clone. No clone ever asked for consent again — that is the
Lume decision criterion, and it is met. lume create 287 s, IPSW fetch 212 s.

The seed passes all ten gate checks, including a desktop capture pulled over
scp from the host.

What the spike changed, all measured

• Driver LaunchAgent execs the bundle binary under launchd
  (com.trycua.cua_driver_daemon). Upstream's open -g -a CuaDriver --args serve makes open the responsible process and the Driver then refuses to
  read its own TCC state.
• AccountInfo:FirstLogins in loginwindow's preferences is what suppresses
  macOS's first-login Setup Assistant. Lume's offline setup does not complete
  it, and the documented com.apple.SetupAssistant keys do nothing on 26.6.2.
• lume ssh is not argv-safe: it joins argv with spaces and the guest
  re-parses it, so lume ssh vm /bin/bash -c '<script>' arrives mangled.
  lib.sh composes one shell line and carries the payload as base64.
• 1920x1200, not 1440x900: at the smaller size macOS clips Setup
  Assistant's buttons off-screen.
• In-guest Screen Sharing dropped: launchctl enable system/com.apple.screensharing fails on macOS 26, and Lume already serves a
  per-VM VNC console.
• Sequoia is not the train: its last full restore image is 15.6.1 (2025-08-20).

Findings for the backend

1. A clone re-runs Setup Assistant even though the seed completed it and
   keeps it suppressed across its own reboots; killing it logs the session out.
   The Driver is unaffected, so verify.sh --clone skips only the
   desktop-session check — but an agent handed a clone sees the wizard. Open
   defect, documented, not hidden.
2. Lume's API accepts a third macOS guest and silently ignores it:
   POST /lume/vms/<n>/run returns 202 {"status":"pending"}, the VM stays
   stopped, and only lume serve's log says The number of virtual machines exceeds the limit. The backend must count running guests itself.
3. lume run --detach fails without a controlling terminal (nohup: can't detach from console); start VMs through the HTTP API.
4. Lume's per-VM VNC server listens on every interface while the API is
   loopback-only.
5. cua-driver status | head panics the CLI on a broken pipe.

Host hardening (owner's conditions)

• lume serve runs as agentcompute and binds 127.0.0.1:7777 only —
  verified with lsof and by failed connects from the LAN and tailnet
  addresses.
• The server key is forwarding-only: forced command, AllowTcpForwarding local, PermitOpen 127.0.0.1:7777, duplicated root-owned in
  /etc/ssh/sshd_config.d/110-agentcompute.conf. Proven: command execution
  refused, :7777 forward serves the API, :22 and :5900 forwards rejected
  administratively prohibited, remote forwarding rejected outright.
  Correction to the spec: restrict alone does not block command
  execution — without the forced command ssh host whoami succeeded.
• Tailnet ACL is a separate PR, feat(tailscale): reserve the Mac backend's SSH port for the agentcompute server networking#21, deliberately unmerged
  until the host is tagged.

Still not in this PR: internal/lume, and no catalog.yaml row — the server
answers platform "mac" is not available yet, so a row would advertise an
image nothing can launch.