macOS Security Baseline

Enables the three security wins every developer Mac should have — FileVault, firewall, Touch ID for sudo — without ever weakening macOS protections. A dev machine holds SSH keys, cloud sessions, and source code: treat it as a privileged endpoint.

When NOT to use

• OS updates, Command Line Tools, Rosetta → macos-system-prep
• SSH keys, commit signing, GitHub auth → git-ssh-identity
• "App is blocked by Gatekeeper" → not this skill's job; never disable Gatekeeper globally (spctl --master-disable was removed in Sequoia). Point the user at the per-app System Settings override and stop.
• Finder/Dock/keyboard tweaks → macos-defaults

Safety rails