v1.4.5

New: Groundwork offers to run Homebrew's own fix

When Homebrew hits a known-broken state — like the circular libtiff/webp dependency some machines saw — it prints its own remediation commands. Groundwork now catches that during chezmoi apply and offers to run them for you:

• The exact commands are shown in full and validated against a strict whitelist (plain brew invocations only — a tampered suggestion is refused).
• Nothing runs without you answering y at the prompt. Decline, and the commands are left on screen to run yourself.
• On yes, the repair runs and the install retries once, automatically.
• Headless and CI runs never prompt: they print the commands and exit for the operator.

Nothing to do after updating — the next time Homebrew breaks itself, Groundwork will ask instead of stopping.