Detect outdated Homebrew artifacts declared as latest

[codeforester]

Problem

basectl check --profile dev currently reports Homebrew-managed profile artifacts as healthy when the package is installed, even if the manifest declares version: latest and Homebrew considers the package outdated.

A concrete example on this Mac:

gh --version
# gh version 2.89.0 (2026-03-26)

HOMEBREW_NO_AUTO_UPDATE=1 brew outdated gh
# gh

BASE_CACHE_DIR=/private/tmp/base-cache-check env -u BASE_HOME ./bin/basectl check --profile dev --format json
# profile check reports gh as BASE-D104 ok because brew list gh succeeds

This makes gh look healthy even though basectl setup --profile dev conceptually promises the latest Homebrew artifact set. The same installed-but-outdated gap likely applies to project Homebrew artifacts that use version: latest.

Current Behavior

• Profile checks call brew list <package> to decide whether a Homebrew artifact is installed.
• version: latest rejects pinned versions, but does not verify freshness.
• basectl setup skips an installed Homebrew artifact instead of upgrading an outdated one.

Possible Fix

• Teach Homebrew artifact checks to distinguish:
  • missing package,
  • installed and current package,
  • installed but outdated package.
• Use a non-mutating Homebrew signal, probably HOMEBREW_NO_AUTO_UPDATE=1 brew outdated <package>, so check/doctor do not refresh or mutate state.
• Add stable doctor finding semantics for outdated Homebrew artifacts. This may reuse the existing Homebrew artifact status IDs if the meaning remains broad enough, or introduce new IDs if automation needs to distinguish outdated from missing.
• Update setup/reconcile behavior so version: latest can recover an outdated Homebrew artifact, likely with brew upgrade <package> after confirming it is installed and outdated.

Acceptance Criteria

• basectl check --profile dev reports an outdated gh package as not OK with actionable fix guidance.
• basectl doctor --profile dev reports the same condition with stable finding output.
• basectl setup --profile dev --dry-run shows the upgrade action for an installed outdated gh.
• Project Homebrew artifact checks either get the same outdated detection or the issue explicitly documents why profile artifacts are handled first.
• Tests cover missing, installed-current, installed-outdated, and Homebrew unavailable paths without requiring live Homebrew network access.