Add TODO for disabling Spotlight shortcut.
Move to a fork of puppet-boxen.

This gives us a temporary fix for pgAdmin permission problems
until https://github.com/boxen/puppet-boxen/pull/62 is merged.