Refine tap trust warnings

[MikeMcQuaid]

Fixes #22494

• keep brew doctor visibility while moving install-time hints to non-fatal preinstall diagnostics
• document why explicit trust matters before the default changes in Homebrew 6.0.0 or 5.2.0
• clean untrusted hosted-runner taps before test-bot setup so unrelated runner state does not fail brew doctor

---

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same change?
• Have you added an explanation of what your changes do and why you'd like us to include them? Performance claims (e.g. "this is faster") must include Hyperfine benchmarks.
• Have you written new tests (excluding integration tests) for your changes? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) with your changes locally?

---

• AI was used to generate or assist with generating this PR.

OpenAI Codex 5.5 xhigh with local review and testing.

---

[github-code-quality]

Code Coverage Overview

Languages: Ruby

Ruby / code-coverage/simplecov

The overall coverage in the adaptive-bladder branch remains at 78%, unchanged from the main branch.

Show a code coverage summary of the most impacted files.

File	main 63f2962	adaptive-bladder 717fc4b	+/-
trust.rb	88%	88%	0%
install.rb	71%	71%	0%
diagnostic.rb	53%	54%	+1%
utils/tty.rb	91%	92%	+1%
bundle/extensio...de_extension.rb	98%	99%	+1%
download_queue.rb	73%	74%	+1%
test_bot/cleanup_before.rb	47%	59%	+12%

---

_{Updated June 01, 2026 18:47 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}