Write the apps snapshot in config init only on macOS (closes #408)

The default config backed up /Applications on every system. That directory exists only on macOS, so on Linux the first snapshot create stopped on the missing path. config init now writes the apps snapshot only when runtime.GOOS is darwin; the macOS file is unchanged.

Model: opus-5-5 (implementation, review); opus-5-5 (merge)

internal/cli/config.go

@@ -8,6 +8,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"reflect"
+	"runtime"
 	"slices"
 	"strconv"
 	"strings"
@@ -30,7 +31,7 @@ const configSetArgs = 2
 // parent config dirs (e.g. ~/.config) are conventionally traversable.
 const configDirMode = 0o755
 
-// configYAMLIndent matches the 2-space indentation of defaultConfigTemplate,
+// configYAMLIndent matches the 2-space indentation of the default config,
 // so `config set` writes the file back with the same indentation rather than
 // yaml.Marshal's 4-space default.
 const configYAMLIndent = 2
@@ -50,7 +51,22 @@ var (
 			"so the file was not changed")
 )
 
-const defaultConfigTemplate = `# vaultik configuration
+// macOS is the value of runtime.GOOS on macOS.
+const macOS = "darwin"
+
+// defaultConfigText returns the file `config init` writes on the operating
+// system goos, named as runtime.GOOS names it. Only macOS gets the apps
+// snapshot, since /Applications exists nowhere else.
+func defaultConfigText(goos string) string {
+	if goos == macOS {
+		return defaultConfigHead + appsSnapshotConfig + defaultConfigTail
+	}
+
+	return defaultConfigHead + defaultConfigTail
+}
+
+// defaultConfigHead is the default config up to the end of the home snapshot.
+const defaultConfigHead = `# vaultik configuration
 # Documentation: https://sneak.berlin/go/vaultik
 
 # ─── REQUIRED ────────────────────────────────────────────────────────────────
@@ -168,7 +184,10 @@ snapshots:
       - "/Movies/ProxyMedia"
       - "/Music/iTunes/Album Artwork"
       - "/Pictures/iPod Photo Cache"
+`
 
+// appsSnapshotConfig is the apps snapshot of the default config.
+const appsSnapshotConfig = `
   # Third-party applications. OS-provided apps live in /System/Applications
   # on modern macOS and are never in /Applications, but Apple-installed
   # App Store apps (Safari, GarageBand, iWork, iMovie) are excluded since
@@ -189,7 +208,10 @@ snapshots:
       - "/Steam.app"
       - "/VirtualBox.app"
       - "/Utilities/Adobe Installers"
+`
 
+// defaultConfigTail is the default config after the snapshots.
+const defaultConfigTail = `
 # Storage backend (pick ONE of the three forms below).
 #
 # S3-compatible:
@@ -311,7 +333,8 @@ on macOS, ~/.config/ on Linux, /etc/vaultik/ as root).`,
 				return fmt.Errorf("creating config directory %s: %w", dir, err)
 			}
 
-			err = os.WriteFile(path, []byte(defaultConfigTemplate), configFileMode)
+			err = os.WriteFile(path, []byte(defaultConfigText(runtime.GOOS)),
+				configFileMode)
 			if err != nil {
 				return fmt.Errorf("writing config file: %w", err)
 			}
@@ -560,7 +583,7 @@ func yamlPathOnly(root *yaml.Node, keys []string) (*yaml.Node, error) {
 }
 
 // marshalConfigYAML renders a config document tree with 2-space indentation,
-// matching defaultConfigTemplate. yaml.Marshal defaults to 4 spaces, which
+// matching the default config. yaml.Marshal defaults to 4 spaces, which
 // would reindent the whole file on the first `config set` despite the promise
 // to preserve formatting.
 func marshalConfigYAML(root *yaml.Node) ([]byte, error) {