Harden Homebrew update workflow

[toku345]

Summary

• centralize the Homebrew update policy in ~/.homebrew/brew.env
• keep bootstrap behavior explicit while removing duplicated shell exports
• add stable-tag and Bottle attestation controls with regression coverage
• document the named-package update, Cask, tap, recovery, and developer-mode workflows

Why

The existing shell-scoped controls reduced implicit upgrades, but non-interactive Homebrew invocations could bypass them and Homebrew itself was tracking the rolling main branch. This change establishes a single user-level policy and adds a reviewable update runbook.

Impact

Homebrew now loads six managed controls for interactive and non-interactive invocations using the managed home. Routine updates remain named and reviewed, Casks without checksums are rejected, and homebrew/core Bottle attestations are verified through authenticated GitHub CLI access. The bootstrap intentionally defers attestation until the managed environment and authentication are available.

No Formula or Cask upgrades are included in this change.

Validation

• bats tests/bats/ — 194 tests passed
• bats tests/bats/test_update_policy_env.bats — 8 tests passed
• ShellCheck passed (informational SC2016 messages only)
• Bash, POSIX shell, and Fish syntax checks passed
• git diff --check origin/main...HEAD passed
• targeted chezmoi apply and post-apply diff checks passed
• Homebrew 6.0.15 stable confirmed with developer mode disabled
• brew verify ripgrep reported a valid attestation