Link the agent half of user/ on the Mac mini

Manifest lines can now name an OS. The SSH config, pwswitch and espanso are
Linux only, so link-user on the Mac links CLAUDE.md, rules, skills and the
opencode commands and nothing else. link-mcp no longer aborts under the Mac's
bash 3.2 when a server has no token.

setup/scripts/link-mcp

@@ -157,14 +157,17 @@ while read -r name transport target token_var _rest; do
         continue
     fi
 
+    # ${args[@]+...} rather than "${args[@]}": the Mac's bash 3.2 treats an
+    # empty array as unset under set -u and aborts the whole stage.
+    #
     # Re-registering is how a new server or a rotated token reaches the
     # runtime. Removing first avoids the CLI refusing a name it already knows.
     # Neither call may print the token, so both are quiet unless they fail.
     claude mcp remove "$name" -s user >/dev/null 2>&1 || true
     if [[ "$transport" == stdio ]]; then
-        add=(claude mcp add "$name" -s user "${args[@]}" -- "$launcher")
+        add=(claude mcp add "$name" -s user ${args[@]+"${args[@]}"} -- "$launcher")
     else
-        add=(claude mcp add --transport "$transport" "$name" "$url" "${args[@]}" -s user)
+        add=(claude mcp add --transport "$transport" "$name" "$url" ${args[@]+"${args[@]}"} -s user)
     fi
     if "${add[@]}" >/dev/null 2>&1; then
         log "Registered $name."

setup/scripts/link-user

@@ -69,10 +69,12 @@ displace() {
 
 linked=0
 copied=0
+os="$(uname -s | tr '[:upper:]' '[:lower:]')"
 
-while read -r kind source destination; do
+while read -r kind source destination only_on _rest; do
     [[ -n "${kind:-}" ]] || continue
     [[ "$kind" == \#* ]] && continue
+    [[ -z "${only_on:-}" || "$only_on" == "$os" ]] || continue
 
     src="$USER_DIR/$source"
     dst="${destination/#\~/$HOME}"