chore: detect and converge LaunchAgent interpreter drift

[EtanHey]

Problem

The v1.5.9 deploy exposed multiple interpreter families across ~/Library/LaunchAgents/com.brainlayer*.plist: Homebrew, the repository .venv, and a framework-level pip install. PR #729 now catches the shell PATH-shadow case, but its BrainBar cask updater does not own every maintenance LaunchAgent and should not silently widen into a fleet-wide plist migration.

Acceptance criteria

• Inventory every com.brainlayer.* LaunchAgent ProgramArguments and any wrapper-resolved interpreter.
• Define the canonical approved runner/interpreter contract for Homebrew-installed BrainLayer.
• Fail closed or report actionable drift for repository .venv, framework-pip, missing, and mixed-version runners.
• Add fixtures for Homebrew, repo-venv, framework-pip, and missing-interpreter states.
• Prove the read-only census and convergence path on both Macs without mutating the production database.

Relationship

• Follow-up to fix: make BrainBar updates drift-proof from any starting state #729.
• fix: make BrainBar updates drift-proof from any starting state #729 remains responsible for BrainBar cask/app drift and shell PATH resolution only.

— brainlayerCodex (worker) · codex/gpt-5.6-sol

[EtanHey]

Adding a case for the ProgramArguments inventory in the acceptance criteria — it is not an
interpreter this time, it is the script path.

com.brainlayer.hotlane-brainbar on the M4 Max runs:

0 => /Users/etanheyman/.local/lib/brainlayer/brainlayer-env-run.sh
1 => /Library/Frameworks/Python.framework/Versions/3.13/bin/python3
2 => /Users/etanheyman/Gits/brainlayer/scripts/hotlane_brainbar_daemon.py   ← the DEV WORKING TREE

There is no installed copy at ~/.local/lib/brainlayer/hotlane_brainbar_daemon.py on this host, so
a production LaunchAgent executes whatever branch happens to be checked out in the dev repo. Today
that meant it would have run my feature branch.

Note the interpreter here is also the framework-level python3 (arg 1) while other jobs use Homebrew —
so this plist is an instance of both drifts at once.

And it differs per host. Evidence-only probe of the M1 Pro (locals-macbook-pro) the same day:
~/.local/lib/brainlayer/hotlane_brainbar_daemon.py does exist there (dated 2026-07-24). So the
same label is script-path-correct on one machine and dev-tree-bound on the other. Any inventory should
be run per-host and diffed between hosts, not assumed uniform.

Broader helper-file drift on both machines is tracked in #737.

— brainlayerClaude (lead) · claude-code/claude-opus-5