fix: migrate MacPorts paths to Homebrew in agents + scenarios

CHANGELOG.md

@@ -8,6 +8,10 @@ Please choose versions by [Semantic Versioning](http://semver.org/).
 * MINOR version when you add functionality in a backwards-compatible manner, and
 * PATCH version when you make backwards-compatible bug fixes.
 
+## Unreleased
+
+- fix: migrate MacPorts paths to Homebrew across `shellcheck-assistant` (`/opt/local/bin/shellcheck` → `/opt/homebrew/bin/shellcheck` in allowed-tools + docs, drop `port install`), `license-assistant` (`gdate` for current year), and the toolchain-preflight/scaling/findings scenarios (`ast-grep` → `/opt/homebrew/bin/ast-grep`) — MacPorts was removed in the local MacPorts→Homebrew migration.
+
 ## v0.30.1
 
 - fix: checker templates exclude no-fix advisory GO-2026-5932 (`golang.org/x/crypto/openpgp`, unmaintained) — add it to `VULNCHECK_IGNORE` in `Makefile.library`/`Makefile.service`, and introduce a shared `TRIVY_IGNORE` baseline merged with any repo-local `.trivyignore` via a temp ignorefile, and align `Makefile.service`'s `trivy` target with `Makefile.library`'s full flag set (`--db-repository`, `--ignorefile`, `--secret-config`, `--skip-dirs vendor`). Propagates the exclusion to all consuming repos across both scanners.

agents/license-assistant.md

@@ -83,7 +83,7 @@ Check for project markers:
 - Recommend re-invoking with "update" to apply fixes
 
 **Update Mode**:
-- Get current year using: `/opt/local/libexec/gnubin/date +%Y`
+- Get current year using: `gdate +%Y`
 - Create LICENSE file if missing (use detected or default license type)
 - Add README license section if missing
 - For Go: Run `make addlicense` to fix headers (if Makefile target exists)
@@ -205,7 +205,7 @@ This project is licensed under the [LICENSE_TYPE] License - see the [LICENSE](LI
 
 **Simple rule**: Don't overthink copyright years.
 
-- New files: Get current year via `/opt/local/libexec/gnubin/date +%Y`
+- New files: Get current year via `gdate +%Y`
 - Existing files: Keep original year
 - Updating years is OPTIONAL when modifying files
 - NEVER bulk update years just because it's a new year

agents/shellcheck-assistant.md

@@ -4,7 +4,7 @@ description: Use proactively to check shell scripts for errors, portability issu
 model: sonnet
 tools: Read, Write, Edit, Glob, Grep, Bash
 color: Cyan
-allowed-tools: Bash(shellcheck:*), Bash(/opt/local/bin/shellcheck:*), Bash(command -v shellcheck:*)
+allowed-tools: Bash(shellcheck:*), Bash(/opt/homebrew/bin/shellcheck:*), Bash(command -v shellcheck:*)
 ---
 
 # Purpose
@@ -24,7 +24,7 @@ When invoked, you must follow these structured phases:
    - Include Makefiles and other files that may contain shell commands
 
 2. **Verify shellcheck availability:**
-   - Run: `command -v shellcheck` or check `/opt/local/bin/shellcheck` (MacPorts default location)
+   - Run: `command -v shellcheck` or check `/opt/homebrew/bin/shellcheck` (Homebrew default location)
    - If not available, report to user with installation instructions
 
 3. **Inventory all shell scripts:**
@@ -34,7 +34,7 @@ When invoked, you must follow these structured phases:
 ### 2. Analysis Phase
 
 1. **Run shellcheck on each script:**
-   - Execute: `shellcheck --format=json <absolute-path>` (or `/opt/local/bin/shellcheck` if not in PATH)
+   - Execute: `shellcheck --format=json <absolute-path>` (or `/opt/homebrew/bin/shellcheck` if not in PATH)
    - For scripts without shebangs, specify shell: `shellcheck --shell=bash --format=json <absolute-path>`
    - Capture all output including severity levels
 
@@ -240,10 +240,7 @@ All modified files verified with shellcheck.
 **Shellcheck Installation (if needed):**
 
 ```bash
-# macOS (MacPorts) - installs to /opt/local/bin/shellcheck
-sudo port install shellcheck
-
-# macOS (Homebrew)
+# macOS (Homebrew) - installs to /opt/homebrew/bin/shellcheck
 brew install shellcheck
 
 # Debian/Ubuntu

scenarios/001-toolchain-preflight.md

@@ -88,7 +88,7 @@ exit: 2
 stdout: {"stats":{"yamls_run":0,"findings_count":0,"elapsed_ms":0},"findings_by_owner":{},"errors":[{"kind":"missing-tool","tool":"ast-grep","detail":"ast-grep / sg binary not in PATH — install via: npm install -g @ast-grep/cli | brew install ast-grep"}]}
 ```
 
-Host ast-grep after all subshells: `/opt/local/bin/ast-grep`
+Host ast-grep after all subshells: `/opt/homebrew/bin/ast-grep`
 
 ### Results
 
@@ -100,6 +100,6 @@ Host ast-grep after all subshells: `/opt/local/bin/ast-grep`
 - [x] `jq -e '.errors[] | select(.kind == "missing-tool" and .tool == "ast-grep")'` exits `0` — PASS
 - [x] `.stats.yamls_run == 0` and `.findings_by_owner == {}` — PASS
 - [x] Wall-clock under 1 second (pr: 11ms, cr: 10ms, runner: 229ms — all well under 1s) — PASS
-- [x] Host `command -v ast-grep` still resolves (`/opt/local/bin/ast-grep`) — PASS
+- [x] Host `command -v ast-grep` still resolves (`/opt/homebrew/bin/ast-grep`) — PASS
 
 All 9 Expected items: **9/9 PASS**

scenarios/003-scaling-funnel-100-files.md

@@ -96,7 +96,7 @@ Setup confirmed:
 ```
 $ git ls-files '*.go' | wc -l
 100
-$ ast-grep --version  (resolves: /opt/local/bin/ast-grep)
+$ ast-grep --version  (resolves: /opt/homebrew/bin/ast-grep)
 ```
 
 Full scan (`scripts/ast-grep-runner.sh "$WORK"`):

scenarios/004-findings-exist-path.md

@@ -81,7 +81,7 @@ After the scenario passes, the operator should record the measured `(findings_co
 Setup:
 
 ```
-$ ast-grep --version  (resolves: /opt/local/bin/ast-grep)
+$ ast-grep --version  (resolves: /opt/homebrew/bin/ast-grep)
 $ gh pr view 2 --repo bborbe/maintainer --json state,changedFiles -q ...
 state=OPEN changedFiles=1
 $ PR_SHA=536a6e79cef42a3711b55b219af5a12c81f0f087