fix(homebrew): pre-create /usr/local/cli-plugins for docker cask; modernize fact refs

[Defilan]

What

Two related fixes that surfaced during a fresh Mac Studio bootstrap
run today:

1. [BUG] homebrew cask install of docker-desktop fails: sudo without TTY when creating /usr/local/cli-plugins #5: Pre-create /usr/local/cli-plugins so the docker-desktop
   cask install no longer needs sudo. Add --ask-become-pass to
   bootstrap.sh so the new become: true pre-task can acquire
   credentials.
2. [BUG] group_vars/all.yml references deprecated top-level fact var (ansible-core 2.24 removes it) #6: Sweep eight references from the deprecated ansible_user_dir
   top-level fact to the supported ansible_facts['user_dir'] form.

Why

Fixes #5
Fixes #6

./bootstrap.sh died mid-run installing the docker-desktop cask:

sudo: a terminal is required to read the password

Root cause: Docker Desktop's cask postinstall hook does sudo mkdir -p /usr/local/cli-plugins even on Apple Silicon. On a fresh Mac
that directory does not exist, /usr/local/ is root-owned, and brew
runs under become: false so there is no TTY for sudo to prompt.

Pre-creating the directory under the invoking user removes the
sudo step from brew's cask path entirely. The post-fix invocation
of brew install --cask docker-desktop is a pure-user-space install.

The deprecation warning was a free win to bundle with #5: same
playbook file set, easy mechanical sweep, future-proofs against
ansible-core 2.24.

How

#5 — docker-desktop sudo

roles/homebrew/tasks/main.yml gains a pre-task before the cask
loop:

- name: Pre-create /usr/local/cli-plugins for the docker-desktop cask
  become: true
  ansible.builtin.file:
    path: /usr/local/cli-plugins
    state: directory
    owner: "{{ ansible_facts['user_id'] }}"
    group: staff
    mode: '0755'
  when: >-
    homebrew_casks | select('match', '^docker(-desktop)?$') | list | length > 0

The when: clause keeps non-Docker deployments sudo-free.

bootstrap.sh adds --ask-become-pass to the ansible-playbook
invocation so Ansible can prompt for sudo password once when the
new pre-task runs.

#6 — deprecated fact references

Eight occurrences swept from {{ ansible_user_dir }} to
{{ ansible_facts['user_dir'] }}:

• group_vars/all.yml × 3 (src_dir, model_store, foreman_workspace_root)
• roles/foreman/tasks/main.yml × 1
• roles/developer_tools/tasks/main.yml × 2
• roles/opencode/tasks/main.yml × 2

No behavior change today; the playbook keeps working when
ansible-core 2.24 ships and removes the auto-injection.

Verification

Local:

• ansible-playbook --syntax-check clean
• Grep confirms no ansible_user_dir references remain anywhere
• Diff is mechanical: 6 files, +31/-8

CI:

• yamllint, ansible-lint, shellcheck, macos-check, macos-homebrew
  run on every PR
• macos-homebrew is the high-leverage check here: it runs
  ansible-playbook ... --tags 'always,system,homebrew' against
  a fresh GitHub-hosted Apple Silicon runner, which would have
  caught [BUG] homebrew cask install of docker-desktop fails: sudo without TTY when creating /usr/local/cli-plugins #5 if the CI gap from [FEATURE] CI: smoke-test ./bootstrap.sh end-to-end (closes the gap that let #2 ship) #4 (./bootstrap.sh entrypoint
  not exercised) had not also let the EXTRA_ARGS bug slip
• macos-homebrew DOES invoke ansible-playbook directly (not via
  bootstrap.sh), so it exercises the homebrew role end-to-end and
  will fail if the cask install can't complete

Related

• [BUG] ./bootstrap.sh fails with empty 'unrecognized arguments:' when no extra ansible-playbook args supplied #2 / PR fix(bootstrap): EXTRA_ARGS expansion produced phantom empty positional arg #3 — EXTRA_ARGS phantom-arg bug (merged)
• [FEATURE] CI: smoke-test ./bootstrap.sh end-to-end (closes the gap that let #2 ship) #4 — CI gap: bootstrap.sh entrypoint not smoke-tested
• [BUG] homebrew cask install of docker-desktop fails: sudo without TTY when creating /usr/local/cli-plugins #5 — this PR
• [BUG] group_vars/all.yml references deprecated top-level fact var (ansible-core 2.24 removes it) #6 — this PR

Checklist

• Tests / lint pass locally where tools were available
• Conventional commit + DCO-style sign-off
• Documentation updated only where the change is observable to
  users (no doc change in this PR; the --ask-become-pass will
  become visible in the form of a one-time sudo prompt)
• References both issues this PR closes