macOS manifest: arch-aware Homebrew prefix + variable interpolation support

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "pkgbox/tap/darkn3rd/homebrew-tools"]
+	path = pkgbox/tap/darkn3rd/homebrew-tools
+	url = git@github.com:darkn3rd/homebrew-tools.git

configbox/ansible/provision/roles/lessons/tasks/install_step.yml

@@ -68,8 +68,19 @@
         owner: "{{ lessons_user }}"
         mode: '0644'
 
+# interpolate: true (see generate_install_script.rb's own append_lines
+#  comment) has no meaning here - lineinfile writes `line` as plain
+#  Python data, no shell involved, so there's nothing to evaluate a
+#  manifest's own `$(...)`/`$VAR` against. Fail loudly rather than
+#  silently write that text out literally - a step needing real
+#  interpolation has to become a 'script' step instead.
+- name: "append: reject interpolate"
+  when: step.type == 'append' and step.interpolate | default(false)
+  ansible.builtin.fail:
+    msg: "lessons: append '{{ step.name }}' sets interpolate: true, which this role's 'append' task can't honor (lineinfile has no shell to interpolate through) - use a 'script' step instead"
+
 - name: "append"
-  when: step.type == 'append'
+  when: step.type == 'append' and not (step.interpolate | default(false))
   become: true
   vars:
     lessons_append_dests: "{{ ([step.dest] if step.dest is string else step.dest) | map('replace', '$HOME', lessons_home) | list }}"

configbox/chef/cookbooks/lessons/libraries/helpers.rb

@@ -145,6 +145,17 @@ def lessons_install(pkg)
         #  directory gap as 'file' above - append_if_no_line creates the
         #  destination file itself if missing, which needs the directory
         #  to already exist.
+        #
+        # interpolate: true (see generate_install_script.rb's own
+        #  append_lines comment) has no meaning here - append_if_no_line
+        #  writes `line` as plain Ruby content, no shell involved, so
+        #  there's nothing to evaluate a manifest's own `$(...)`/`$VAR`
+        #  against. Fail loudly rather than silently write that text out
+        #  literally - a step needing real interpolation has to become a
+        #  'script' step instead, the same way it was before append:
+        #  existed at all.
+        raise "lessons: append '#{pkg['name']}' sets interpolate: true, which the Chef 'append' case can't honor (append_if_no_line has no shell to interpolate through) - use a 'script' step instead" if pkg['interpolate']
+
         home = Etc.getpwnam(node['lessons']['user']).dir
         Array(pkg['dest']).each do |dest|
           real_dest = dest.sub('$HOME', home)

configbox/puppet/shared_modules/lessons/manifests/install_step.pp

@@ -125,6 +125,16 @@
     }
 
     'append': {
+      # interpolate: true (see generate_install_script.rb's own
+      #  append_lines comment) has no meaning here - file_line writes
+      #  `line` as plain Puppet data, no shell involved, so there's
+      #  nothing to evaluate a manifest's own `$(...)`/`$VAR` against.
+      #  Fail loudly rather than silently write that text out literally -
+      #  a step needing real interpolation has to become a 'script' step
+      #  instead.
+      if 'interpolate' in $step and $step['interpolate'] {
+        fail("lessons::install_step '${title}': append '${step_name}' sets interpolate: true, which this case can't honor (file_line has no shell to interpolate through) - use a 'script' step instead")
+      }
       $raw_dests = $step['dest'] =~ String ? { true => [$step['dest']], default => $step['dest'] }
       $dests = $raw_dests.map |$d| { regsubst($d, '\$HOME', $home) }
       $dests.each |$d| {

scriptbox/config/helpers/common.yml

@@ -3,13 +3,37 @@ common:
   helpers:
     append_line:
       cmd: |
+        # $3 (SUDO_NEEDED, "true"/empty) - a manifest's own appends: entry
+        #  says so explicitly (sudo: true), decided once at generation
+        #  time - see generate_install_script.rb's own append_lines.
+        #  `sudo append_line ...` from the call site can't work instead:
+        #  sudo execs a fresh subprocess and looks up its argument as an
+        #  external program on PATH - it has no visibility into this
+        #  shell's own function table, so it would just fail outright
+        #  with "command not found". The elevation has to happen on
+        #  append_line's own internal touch/tee calls, from inside.
         append_line() {
           local DEST=$1
           local LINE=$2
+          local SUDO_NEEDED=$3
+          local DIR
+          DIR="$(dirname "$DEST")"
+          local SUDO=""
+          [ "$SUDO_NEEDED" = "true" ] && SUDO="sudo"
 
-          mkdir -p "$(dirname "$DEST")"
-          [ -f "$DEST" ] || touch "$DEST"
-          grep -qxF "$LINE" "$DEST" 2>/dev/null || echo "$LINE" >> "$DEST"
+          $SUDO mkdir -p "$DIR"
+          [ -f "$DEST" ] || $SUDO touch "$DEST"
+          if ! grep -qxF "$LINE" "$DEST" 2>/dev/null; then
+            # sudo echo ... >> "$DEST" would NOT actually gain root for
+            #  the redirection - >> is set up by *this* unprivileged
+            #  shell before sudo ever runs. sudo tee -a is the real fix,
+            #  piped rather than prefixed, only when actually needed.
+            if [ -n "$SUDO" ]; then
+              echo "$LINE" | sudo tee -a "$DEST" >/dev/null
+            else
+              echo "$LINE" >> "$DEST"
+            fi
+          fi
         }
       cmd_powershell: |
         function append_line {