feat(install): system-wide low-disk login warning via /etc/profile.d

Add etc/profile.d/disk-usage-warning.sh (POSIX sh) that warns in bold
red at login when / or /home cross 85% usage. Deployed system-wide via
install_disk_warning() (sudo install -D -m 0644), gated inside the
apt-get block since df --output=pcent and /etc/profile.d are GNU/Debian
conventions absent on macOS. Idempotent and re-runnable.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CN1KSmsuLG6TxSeN5m8xvM

.claude/memory/decisions.md

@@ -33,3 +33,10 @@ Implemented install.sh `setup_remote_desktop` + `ensure_rdp_credentials`. Connec
 Alts rejected: (a) force Xorg GDM + xrdp — sacrifices Wayland desktop, fragile; (b) VNC (wayvnc) —
 RDP preferred (mstsc native on Win client, TLS); (c) g-r-d user "Desktop Sharing" mode — shares
 existing local session, wanted independent headless login. See LRN-004, BLK-004. Status: done.
+
+## BDR-006 — Disk-usage login warning deployed system-wide to /etc/profile.d
+2026-06-24. New `etc/profile.d/disk-usage-warning.sh` (POSIX sh, bold-red warn when / or /home ≥85%)
+deployed via `sudo install -D -m 0644` to `/etc/profile.d/` from `install_disk_warning()`, gated in
+the apt-get Linux block (see LRN-005). Alt rejected: per-user append to `~/.bashrc` — wanted the warn
+for EVERY login account on the box, not just the installing user, so system-wide profile.d won. Known
+limit: login-shell scope only (non-login terminals miss it). Status: done.

.claude/memory/journal.md

@@ -26,3 +26,9 @@ xrdp abandoned (Wayland-only GNOME kills Xorg session). Replaced install_xrdp
 empty (BLK-004); 2-layer auth gate→GDM PAM (LRN-004). Added ensure_rdp_credentials (prompt, TTY-guard,
 idempotent). Connection CONFIRMED live. install.sh committed 0bd936b (bash -n + shellcheck CLEAN);
 push blocked here (HTTPS remote, no creds in env) → user pushes. TPM GKeyFile-fallback warn harmless.
+
+## 2026-06-24 — disk-usage login warning
+Added etc/profile.d/disk-usage-warning.sh (POSIX sh, warns bold red when / or /home ≥85%).
+install_disk_warning() in install.sh: sudo install -D -m 0644 → /etc/profile.d, gated in apt block
+(Linux-only: df --output=pcent GNU-only + /etc/profile.d Debian convention). shellcheck + sh -n CLEAN,
+both code paths runtime-verified. README + CLAUDE.md synced. Not committed (master, user to confirm).

.claude/memory/learnings.md

@@ -29,3 +29,10 @@ enable+start `gnome-remote-desktop.service`. Auth = 2 layers: shared gate creds
 Listening socket + TLS + enable NOT enough alone. TPM warn `Init TPM credentials failed ... using
 GKeyFile as fallback` = harmless on TPM-less host (creds → keyfile). Connect: client → ip:3389,
 accept self-signed cert, gate creds, then GDM user. Supersedes LRN-003 for Wayland GNOME.
+
+## LRN-005 — df --output=pcent is GNU-only → keep /etc/profile.d disk scripts Linux-gated
+2026-06-24. `df --output=pcent` (and `/etc/profile.d` itself) are GNU coreutils / Debian conventions,
+absent on macOS BSD df. Any install step deploying such a snippet system-wide must sit inside the
+`command -v apt-get` (Linux) block, never the OS-agnostic path. Deploy idempotently with
+`sudo install -D -m 0644 src /etc/profile.d/x.sh` (-D makes the dir, overwrite = re-runnable). Caveat:
+`/etc/profile.d/*.sh` runs for LOGIN shells only — non-login terminals need `/etc/bash.bashrc` instead.