Link the agent half of user/ on the Mac mini

Manifest lines can now name an OS. The SSH config, pwswitch and espanso are
Linux only, so link-user on the Mac links CLAUDE.md, rules, skills and the
opencode commands and nothing else. link-mcp no longer aborts under the Mac's
bash 3.2 when a server has no token.

tests/setup/user-content-contract

@@ -46,13 +46,15 @@ done < <(find "$repo_dir/user" -type f \( -name 'id_*' -o -name '*.pem' -o -name
 
 # ── Every manifest line is usable ───────────────────────────────────────────
 
-while read -r kind source destination; do
+while read -r kind source destination only_on; do
     [[ -e "$repo_dir/user/$source" ]] \
         || note "the manifest points at $source, which is not in user/"
     [[ "$kind" == link || "$kind" == linkdir || "$kind" == copy ]] \
         || note "the manifest uses an unknown kind: $kind"
     [[ "$destination" == '~/'* ]] \
         || note "the manifest destination $destination is not under the home directory"
+    [[ -z "$only_on" || "$only_on" == linux || "$only_on" == darwin ]] \
+        || note "the manifest names an unknown os: $only_on"
 done < <(grep -vE '^\s*(#|$)' "$manifest")
 
 # ── The behaviour, against a fake home ──────────────────────────────────────
@@ -77,6 +79,7 @@ linkdir  agents/skills     ~/.agents/skills
 linkdir  agents/skills     ~/.claude/skills
 copy     plain.txt         ~/.config/plain.txt
 link     missing.txt       ~/.config/missing.txt
+copy     plain.txt         ~/.config/elsewhere.txt  nosuchos
 FIXTURE
 
 home="$work/home"
@@ -141,6 +144,11 @@ fi
 grep -q 'missing.txt' "$work/log" \
     || note 'a skipped manifest entry was not reported'
 
+# A line naming another OS is for another machine. The Mac takes the agent half
+# of user/ and none of the Linux desktop half.
+[[ -e "$home/.config/elsewhere.txt" ]] \
+    && note 'a manifest entry for another OS was applied here'
+
 # ── The answer sticks ───────────────────────────────────────────────────────
 #
 # So that `panama upgrade` on a configured machine relinks without an interview,