feat: add mac-optimizer skill (92) — Claude Code only

macOS system health toolkit with 5 audit modules (packages, environment,
security, cleanup, resources) and cleanup executor. Fixed bugs from review:
- Replace GNU timeout with perl alarm (macOS compatible)
- Remove Linux-only ps --sort flag, use portable sort
- Add JSON escaping to all audit scripts
- Remove redundant classify_size branch

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

custom-skills/92-mac-optimizer/references/security-checks.md

@@ -0,0 +1,53 @@
+# Security Checks Reference
+
+## SIP (System Integrity Protection)
+- **Check**: `csrutil status`
+- **Expected**: "System Integrity Protection status: enabled."
+- **Remediation**: Reboot to Recovery Mode (Cmd+R), open Terminal, run `csrutil enable`
+- **Severity**: Critical if disabled
+
+## Gatekeeper
+- **Check**: `spctl --status`
+- **Expected**: "assessments enabled"
+- **Remediation**: `sudo spctl --master-enable`
+- **Severity**: Critical if disabled
+
+## Firewall
+- **Check**: `/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate`
+- **Fallback**: `defaults read /Library/Preferences/com.apple.alf globalstate` (0=off, 1=on, 2=essential)
+- **Remediation**: System Settings > Network > Firewall > Turn On
+- **Severity**: Critical if disabled
+
+## FileVault
+- **Check**: `fdesetup status`
+- **Expected**: "FileVault is On."
+- **Remediation**: System Settings > Privacy & Security > FileVault > Turn On
+- **Severity**: Critical if disabled (disk not encrypted)
+
+## Open Ports
+- **Check**: `lsof -iTCP -sTCP:LISTEN -nP`
+- **Review**: unexpected services listening on all interfaces (0.0.0.0 or *)
+- **Severity**: Info (review needed, not automatically bad)
+
+## SSH Configuration
+- **Check**: `/etc/ssh/sshd_config`
+- **Flags**: `PasswordAuthentication yes`, `PermitRootLogin yes`
+- **Remediation**: Set to `no` and restart sshd
+- **Severity**: Warning
+
+## Remote Services
+- **Remote Login**: `systemsetup -getremotelogin`
+- **Remote Management**: `defaults read /Library/Preferences/com.apple.RemoteManagement ARD_AllLocalUsers`
+- **Remediation**: Disable in System Settings > General > Sharing
+- **Severity**: Info/Warning depending on context
+
+## Software Updates
+- **Check**: `softwareupdate -l` (can be slow, 30s timeout)
+- **Remediation**: System Settings > General > Software Update
+- **Severity**: Warning if updates available
+
+## Screen Lock
+- **Check**: `defaults -currentHost read com.apple.screensaver idleTime`
+- **Check**: `defaults read com.apple.screensaver askForPassword`
+- **Remediation**: System Settings > Lock Screen
+- **Severity**: Warning if password not required