feat(workstation): add mac-defaults validation helper and CI workflow

.github/workflows/workstation-mac-defaults-validation.yml

@@ -0,0 +1,69 @@
+name: workstation-mac-defaults-validation
+
+on:
+  pull_request:
+    paths:
+      - 'profiles/linux-dev/workstation-v0/bin/check-mac-defaults.sh'
+      - 'profiles/linux-dev/workstation-v0/gnome/mac-defaults.sh'
+      - 'profiles/linux-dev/workstation-v0/gnome/README.md'
+      - '.github/workflows/workstation-mac-defaults-validation.yml'
+  push:
+    branches:
+      - main
+    paths:
+      - 'profiles/linux-dev/workstation-v0/bin/check-mac-defaults.sh'
+      - 'profiles/linux-dev/workstation-v0/gnome/mac-defaults.sh'
+      - 'profiles/linux-dev/workstation-v0/gnome/README.md'
+      - '.github/workflows/workstation-mac-defaults-validation.yml'
+
+jobs:
+  mac-defaults-smoke:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Syntax check mac-defaults scripts
+        run: |
+          set -euo pipefail
+          bash -n profiles/linux-dev/workstation-v0/gnome/mac-defaults.sh
+          bash -n profiles/linux-dev/workstation-v0/bin/check-mac-defaults.sh
+
+      - name: "Smoke: helper emits required keys"
+        run: |
+          set -euo pipefail
+          helper='profiles/linux-dev/workstation-v0/bin/check-mac-defaults.sh'
+          out=$(bash "$helper")
+          grep -F 'mac_defaults_script=present' <<<"$out" >/dev/null
+          grep -F 'hot_corners_disabled='       <<<"$out" >/dev/null
+          grep -F 'clock_format_12h='           <<<"$out" >/dev/null
+          grep -F 'locate_pointer_enabled='     <<<"$out" >/dev/null
+          grep -F 'nautilus_double_click='      <<<"$out" >/dev/null
+          grep -F 'dock_favorites_seed='        <<<"$out" >/dev/null
+          grep -F 'files_binding_super_e='      <<<"$out" >/dev/null
+          grep -F 'terminal_binding_super_ret=' <<<"$out" >/dev/null
+          grep -F 'screenshot_binding_3='       <<<"$out" >/dev/null
+          grep -F 'screenshot_binding_4='       <<<"$out" >/dev/null
+          grep -F 'screenshot_binding_5='       <<<"$out" >/dev/null
+          grep -F 'screenshot_binding_6='       <<<"$out" >/dev/null
+          grep -F 'mac_defaults_ok='            <<<"$out" >/dev/null
+
+      - name: "Smoke: helper detects all required settings as present"
+        run: |
+          set -euo pipefail
+          helper='profiles/linux-dev/workstation-v0/bin/check-mac-defaults.sh'
+          out=$(bash "$helper")
+          grep -F 'hot_corners_disabled=present'       <<<"$out" >/dev/null
+          grep -F 'clock_format_12h=present'           <<<"$out" >/dev/null
+          grep -F 'locate_pointer_enabled=present'     <<<"$out" >/dev/null
+          grep -F 'nautilus_double_click=present'      <<<"$out" >/dev/null
+          grep -F 'dock_favorites_seed=present'        <<<"$out" >/dev/null
+          grep -F 'files_binding_super_e=present'      <<<"$out" >/dev/null
+          grep -F 'terminal_binding_super_ret=present' <<<"$out" >/dev/null
+          grep -F 'screenshot_binding_3=present'       <<<"$out" >/dev/null
+          grep -F 'screenshot_binding_4=present'       <<<"$out" >/dev/null
+          grep -F 'screenshot_binding_5=present'       <<<"$out" >/dev/null
+          grep -F 'screenshot_binding_6=present'       <<<"$out" >/dev/null
+          grep -F 'mac_defaults_ok=yes'                <<<"$out" >/dev/null

profiles/linux-dev/workstation-v0/bin/check-mac-defaults.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Validate the workstation-v0 mac-like GNOME defaults pack.
+# Inspects mac-defaults.sh for required settings without running GNOME.
+# Emits key=value lines for CI, status, and doctor integration.
+# This helper is read-only: it does not modify any settings.
+
+profile_dir(){
+  cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd
+}
+
+check_script(){
+  local key=$1
+  local pattern=$2
+  local file=$3
+  if grep -qF "$pattern" "$file" 2>/dev/null; then
+    printf '%s=present\n' "$key"
+  else
+    printf '%s=missing\n' "$key"
+  fi
+}
+
+main(){
+  local pdir script overall_ok
+  pdir="$(profile_dir)"
+  script="$pdir/gnome/mac-defaults.sh"
+  overall_ok=no
+
+  if [[ -f "$script" ]]; then
+    printf 'mac_defaults_script=present\n'
+  else
+    printf 'mac_defaults_script=missing\n'
+    printf 'mac_defaults_ok=no\n'
+    return
+  fi
+
+  check_script hot_corners_disabled        "enable-hot-corners false"                    "$script"
+  check_script clock_format_12h            "clock-format '12h'"                          "$script"
+  check_script locate_pointer_enabled      "locate-pointer true"                         "$script"
+  check_script nautilus_double_click       "click-policy 'double'"                       "$script"
+  check_script dock_favorites_seed         "favorite-apps"                               "$script"
+  check_script files_binding_super_e       'set_custom_binding custom1 "SourceOS Files"' "$script"
+  check_script terminal_binding_super_ret  'set_custom_binding custom2 "SourceOS Terminal"' "$script"
+  check_script screenshot_binding_3        'set_custom_binding custom3'                  "$script"
+  check_script screenshot_binding_4        'set_custom_binding custom4'                  "$script"
+  check_script screenshot_binding_5        'set_custom_binding custom5'                  "$script"
+  check_script screenshot_binding_6        'set_custom_binding custom6'                  "$script"
+
+  if grep -qF "enable-hot-corners false"                    "$script" &&
+     grep -qF "clock-format '12h'"                          "$script" &&
+     grep -qF "locate-pointer true"                         "$script" &&
+     grep -qF "click-policy 'double'"                       "$script" &&
+     grep -qF "favorite-apps"                               "$script" &&
+     grep -qF 'set_custom_binding custom1 "SourceOS Files"' "$script" &&
+     grep -qF 'set_custom_binding custom2 "SourceOS Terminal"' "$script"; then
+    overall_ok=yes
+  fi
+  printf 'mac_defaults_ok=%s\n' "$overall_ok"
+}
+
+main "$@"

profiles/linux-dev/workstation-v0/gnome/README.md

@@ -59,6 +59,32 @@ The workstation keeps keyboard remapping explicit and policy-gated:
 - Kinto remains an explicit compatibility lane for X11/xkeysnail-style workflows and is not auto-installed in the Wayland-first profile.
 - `check-keyboard-policy.sh` emits key=value status for CI and future doctor/status integration.
 
+## Mac-defaults validation
+
+The mac-like GNOME defaults pack can be inspected without changing system state:
+
+```bash
+./profiles/linux-dev/workstation-v0/bin/check-mac-defaults.sh
+```
+
+The helper emits key=value output for:
+
+- `mac_defaults_script`
+- `hot_corners_disabled`
+- `clock_format_12h`
+- `locate_pointer_enabled`
+- `nautilus_double_click`
+- `dock_favorites_seed`
+- `files_binding_super_e`
+- `terminal_binding_super_ret`
+- `screenshot_binding_3`, `screenshot_binding_4`, `screenshot_binding_5`, `screenshot_binding_6`
+- `mac_defaults_ok`
+
+It is read-only and does not require a GNOME session. It verifies that
+`mac-defaults.sh` records the intended desktop behavior slice by inspecting
+the script source. The check is wired into the
+`workstation-mac-defaults-validation` CI workflow.
+
 ## Dock/extension validation
 
 The dock and extension lane can be inspected without changing system state: