tcc: gate cltbld-TCC.db-dependent resources on a custom fact

[rcurranmoz]

Summary

Fixes #1208.

Replaces the log-grep reboot trigger in run-puppet.sh with a proactive fact-based gate.

The bootstrap script currently does this:

```bash
if grep -q "unable to open database \"/Users/cltbld/.../TCC.db" "$TMP_LOG"; then
echo "Detected TCC.db issue. A reboot is required."
sudo shutdown -r now
exit 0
fi
```

That string is Apple-controlled (we'd silently lose the trigger if Apple rewords or localizes it), reboots mid-apply (so downstream resources never run in this pass), and can't distinguish "cltbld TCC.db not ready yet" from "cltbld TCC.db permanently broken" — same string, very different remediation.

Changes

• New custom fact `cltbld_tcc_db_present` in `modules/macos_tcc_perms/lib/facter/`. Boolean — true iff `/Users/cltbld/Library/Application Support/com.apple.TCC/TCC.db` exists.
• `macos_tcc_perms`: gates the `execute tcc perms script` exec on `$facts['cltbld_tcc_db_present']`.
• `macos_safaridriver`: gates `execute perms script` and `execute enable remote automation script` on the same fact (both write to or depend on cltbld's TCC.db).
• `run-puppet.sh`: removes the log-grep block. Adds a post-success check — if cltbld TCC.db is still missing after a clean apply, the script reboots once so autologin can fire; the next apply (via bootstrap LaunchDaemon macos_run_puppet: make bootstrap reboot-survivable via LaunchDaemon #1206 or the regular at-boot mechanism) will see the fact flip to true and apply the resources cleanly.

Behavior on a fresh host

1. First apply: autologin set up, TCC resources skipped (no errors)
2. Post-success check sees TCC.db absent → reboot
3. cltbld autologs in → TCC.db materializes
4. Next apply: TCC resources actually run

Test plan

• Fresh M4 host (cltbld absent at start of apply): puppet apply completes without errors, post-success check triggers reboot, second apply applies TCC perms
• Already-bootstrapped host (cltbld TCC.db present): TCC resources apply normally, no reboot
• Kitchen mac suite: `running_in_test_kitchen` guard still keeps TCC resources from firing
• Confirm `facter -p cltbld_tcc_db_present` returns the correct boolean on a managed host
• Linux suites unaffected (fact is confined to Darwin)

Related

Pairs naturally with #1206 (reboot-survivable bootstrap LaunchDaemon) — together they eliminate the babysitter ssh pattern entirely.

🤖 Generated with Claude Code