fix(portability): make test green on macOS, GNU-only idioms replaced

The suite and seven libs assumed a GNU userland: `cmd | grep -q` under
pipefail (grep exits at the first match, the producer takes SIGPIPE,
rc 141 → 15 false "merged into" FAILs in gitflow-test), `sed -i` with no
suffix, `wc -l` padding compared as a string, `stat -c`, `touch -d`,
`realpath -m` (gstack-links refusal never fired), bare `timeout` off the
sanitized PATH (design gate READY BUT UNVERIFIED), `grep -oP` (update-all
emptied the plugin list). Thirteen suites were red on this machine.

Portable forms on the native userland of both OS: producer captured out
of the pipeline, `sed -i.bak` in tests and a temp-sibling `sed_profile`
on the user dotfile, `tr -d ' '`, python3 perms, `touch -t`, a
`realpath -m` emulation that refuses `..`, perl `alarm` for the 15 s
bound, `sed -n` token extraction. Regression tests: gstack-links T4b,
doctrine-citers Alphabet/Alpha flip, profile-set-managed T18 (failing CLI
no longer aborts `set`), new portability-census suite over the tracked
shell files. Linux run deferred (see TODO).

update-all.sh

@@ -603,8 +603,9 @@ fi
 echo ""
 echo "── Updating marketplace plugins..."
 if command -v claude &>/dev/null; then
+  # sed -n: BSD grep has no PCRE mode (rc 2 emptied the list)
   _plugins=$(claude plugin list 2>/dev/null \
-    | grep -oP '(?<=❯ )\S+' || true)
+    | sed -n 's/.*❯ \([^[:space:]][^[:space:]]*\).*/\1/p' || true)
   if [ -n "$_plugins" ]; then
     while IFS= read -r _p; do
       _name="${_p%%@*}"