fix(global): install prepares host trust env independent of keychain step

Mirrors the globalTrust restructure into bootstrapMacGlobalInstall:
configureMacHostTlsTrust runs once a cert path exists, with a note
when the keychain step didn't complete. Also neutralizes fixture
paths that tripped the privacy check in CI.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: roodboi

src/commands/global.ts

@@ -723,8 +723,15 @@ async function bootstrapMacGlobalInstall(): Promise<void> {
   const certPath = await exportCaddyLocalCaCert();
   if (certPath) {
     const trustReady = await ensureMacTrustCaddyLocalCa({ certPath });
-    if (trustReady) {
-      await configureMacHostTlsTrust({ certPath });
+    // Mirror globalTrust: the host trust env (Bun/Node/curl/git) is
+    // independent of the macOS System keychain step — prepare it regardless
+    // so non-interactive installs still get CLI-tool trust.
+    await configureMacHostTlsTrust({ certPath });
+    if (!trustReady) {
+      note(
+        "Host trust env is prepared, but the browser will still show warnings for https://*.hack until the System keychain step runs. Run `hack global trust` interactively to finish it.",
+        "TLS"
+      );
     }
   }
   await maybeOfferMacRecoverySetup();

tests/daemon-orphan.test.ts

@@ -3,7 +3,7 @@ import { expect, test } from "bun:test";
 import { findOrphanDaemonProcesses } from "../src/daemon/process.ts";
 
 const PS_LINES = [
-  "  123 /Users/x/.hack/bin/hack daemon start --foreground",
+  "  123 /tmp/hack-home/.hack/bin/hack daemon start --foreground",
   "  456 /opt/homebrew/bin/hack daemon start --foreground",
   "  789 vim src/commands/daemon.ts",
   "  999 hack daemon status",
@@ -44,7 +44,7 @@ import {
 
 test("virtual bunfs executable paths are rejected", () => {
   expect(isVirtualExecutablePath("/$bunfs/root/hack")).toBe(true);
-  expect(isVirtualExecutablePath("/Users/x/.hack/bin/hack")).toBe(false);
+  expect(isVirtualExecutablePath("/tmp/hack-home/.hack/bin/hack")).toBe(false);
 });
 
 test("extracts the launchd program path from plist text", () => {

tests/global-command.macos.test.ts

@@ -1412,3 +1412,74 @@ test("global trust skips the keychain step under --no-interactive when sudo need
     ])
   );
 });
+
+test("global install still prepares host TLS env when keychain trust is declined", async () => {
+  await prepareManagedTools(tempDir!);
+  reachabilityByHost = {
+    [DEFAULT_CADDY_IP]: true,
+    [DEFAULT_HOST_DNS_IP]: true,
+  };
+  confirmResponder = () => false;
+
+  const localCaPath = join(
+    tempDir!,
+    GLOBAL_HACK_DIR_NAME,
+    GLOBAL_CADDY_DIR_NAME,
+    "pki",
+    "caddy-local-authority.crt"
+  );
+  await mkdir(dirname(localCaPath), { recursive: true });
+  await writeFile(
+    localCaPath,
+    "-----BEGIN CERTIFICATE-----\nLOCAL\n-----END CERTIFICATE-----\n"
+  );
+
+  execMockResponder = (cmd) => {
+    if (
+      cmd[0] === "docker" &&
+      cmd[1] === "compose" &&
+      cmd[2] === "-f" &&
+      cmd[4] === "ps"
+    ) {
+      return { exitCode: 0, stdout: "caddy-123\n", stderr: "" };
+    }
+    if (
+      cmd[0] === "security" &&
+      cmd[1] === "find-certificate" &&
+      cmd[2] === "-a" &&
+      cmd[3] === "-p"
+    ) {
+      return {
+        exitCode: 0,
+        stdout:
+          "-----BEGIN CERTIFICATE-----\nSYSTEM\n-----END CERTIFICATE-----\n",
+        stderr: "",
+      };
+    }
+    return null;
+  };
+
+  const { runCli } = await import("../src/cli/run.ts");
+  const code = await runCli(["global", "install"]);
+
+  const bundlePath = join(
+    tempDir!,
+    GLOBAL_HACK_DIR_NAME,
+    GLOBAL_CADDY_DIR_NAME,
+    "pki",
+    "caddy-host-trust-bundle.pem"
+  );
+  const envScriptPath = join(
+    tempDir!,
+    GLOBAL_HACK_DIR_NAME,
+    GLOBAL_CADDY_DIR_NAME,
+    "pki",
+    "caddy-host-trust-env.sh"
+  );
+
+  expect(code).toBe(0);
+  // Same contract as `global trust`: declining the System keychain step
+  // (browser trust) must not block the Bun/Node/curl/git host trust env.
+  expect(await Bun.file(bundlePath).text()).toContain("LOCAL");
+  expect(await fileExists(envScriptPath)).toBe(true);
+});