fix(macos): sanitize Homebrew installer environment

[agiletalk]

Summary

• download the official Homebrew installer to a temporary file and validate its shebang before execution
• isolate Homebrew's child environment so inherited mode flags cannot conflict
• keep --yes non-interactive while allowing the normal curl | bash path to prompt through /dev/tty
• add upstream-compatible environment regression tests on both Ubuntu and macOS
• align VERSION with the next patch after the current v0.10.7 release

Root cause

The prerequisites step always launched Homebrew with NONINTERACTIVE=1, so a fresh interactive Mac could not authorize Homebrew's administrator operation. The first attempted fix added INTERACTIVE=1, but Homebrew explicitly aborts when that variable is combined with an inherited CI or NONINTERACTIVE value.

This version launches Homebrew in isolated subshells:

• interactive: removes CI and NONINTERACTIVE, exports only INTERACTIVE=1, and connects stdin to /dev/tty
• --yes: removes an inherited INTERACTIVE value and exports NONINTERACTIVE=1

The caller's environment remains unchanged.

Follow-up to PR #4 feedback

1. The fake installer now reproduces Homebrew's real CI+INTERACTIVE and NONINTERACTIVE+INTERACTIVE abort conditions.
2. The branch starts from current main at v0.10.7; the stale 0.9.1 change is replaced with 0.10.8.
3. tests/homebrew-installer.sh runs in the Ubuntu lint job and the macos-14 dry-run job, so the BSD script branch is exercised on macOS.
4. This remains a draft until the external-contributor workflow is approved and the complete CI matrix passes.

User impact

A normal one-line install can now let the official Homebrew installer request the Mac administrator password once. lazy-starter-kit itself still does not invoke a separate sudo command. Automated --yes runs remain prompt-free.

Validation

• Bash syntax checks across the macOS/Linux installers and shell tests
• ShellCheck 0.11.0 with the repository's CI flags
• Node syntax checks for both AI guard scripts
• tests/homebrew-installer.sh
• tests/macos-existing-home.sh
• tests/zdotdir-existing-home.sh
• tests/safe-recursive-delete.sh
• tests/ai-shell-guard.sh
• tests/release-signing.sh
• Linux installer dry-run

The new macOS TTY regression is wired into GitHub Actions and must be confirmed by the macos-14 runner.