Deduplicate first-mile install and bootstrap Bash helpers

[codeforester]

Problem

bootstrap.sh and install.sh duplicate first-mile installer code that cannot rely on base-bash-libs yet:

• *_expand_path helpers have matching ShellCheck SC2088 warnings for quoted tilde patterns.
• Homebrew installer fetch, checksum verification, temp-file management, and execution are duplicated.

The duplication is understandable because these scripts run before Base runtime bootstrap, but it should be intentional and tested rather than drifting independently.

Scope

• Deduplicate or generate the shared first-mile installer helper logic used by bootstrap.sh and install.sh.
• Fix the quoted-tilde ShellCheck warnings without changing path expansion behavior.
• Keep these scripts independent from base-bash-libs and base_init.sh.

Acceptance Criteria

• bootstrap.sh and install.sh preserve current user-facing behavior.
• The duplicated Homebrew installer verification logic has a single maintained source or a clearly generated/shared snippet.
• Shell syntax and warning-level ShellCheck pass for the touched files.