Fix bin/ci's skipped signoff and native builds racing for Homebrew

.dockerignore

@@ -0,0 +1,4 @@
+# Agent worktrees under .claude/ are whole extra checkouts of this repo; the test images
+# copy only what they build from, so neither they nor .git belong in the build context.
+.claude
+.git

bin/ci

@@ -224,7 +224,10 @@ build_matrix() {
 # --- Signoff ----------------------------------------------------------------
 signoff() {
   heading "📋 Signoff" "gh signoff"
-  if ! command -v gh >/dev/null || ! gh extension list 2>/dev/null | grep -q gh-signoff; then
+  # Not `grep -q`: it exits at the first match, gh dies writing the rest of its list
+  # (SIGPIPE, 141), and pipefail reports the pipeline as failed. That skipped the signoff
+  # on most green runs, while CI still exited 0. Plain grep reads to the end.
+  if ! command -v gh >/dev/null || ! gh extension list 2>/dev/null | grep gh-signoff >/dev/null; then
     printf '%s  – skipped: gh signoff not installed (gh extension install basecamp/gh-signoff)%s\n' \
       "$SUBTITLE" "$RESET"
     return 0

test/build

@@ -34,9 +34,11 @@ JOBS=${JOBS:-$(( CORES / 2 ))}
 (( JOBS > 16 )) && JOBS=16
 MAKE_JOBS=${MAKE_JOBS:-4}
 
-# Use multi-platform builder if available (faster cross-arch builds)
+# Use multi-platform builder if available (faster cross-arch builds). Plain grep to
+# /dev/null, not `grep -q`: under pipefail, -q exiting early can SIGPIPE the writer and
+# fail the whole test (bin/ci's signoff check lost runs to exactly that).
 BUILDER=""
-if docker buildx ls 2>/dev/null | grep -A2 "^multiarch" | grep -q "running"; then
+if docker buildx ls 2>/dev/null | grep -A2 "^multiarch" | grep "running" >/dev/null; then
   BUILDER="multiarch"
 fi
 
@@ -302,6 +304,23 @@ case " $platforms " in
       exit 1
     fi
     echo "Using ruby-build: $RUBY_BUILD"
+
+    # The definitions `brew install` what they need, and parallel native builds then race
+    # for Homebrew's lock: each one auto-updates first, and the losers die within seconds
+    # on "Another `brew update` process is already running". Install everything the chosen
+    # definitions ask for once, here, one at a time, then turn auto-update off so their own
+    # `brew install`s are no-ops on installed formulae, which run side by side fine.
+    if command -v brew >/dev/null 2>&1; then
+      formulae=$(grep -ho 'brew install [^ ;&|)]*' $versions 2>/dev/null | awk '{ print $3 }' | sort -u || true)
+      for formula in $formulae; do
+        echo "Installing $formula for the native builds..."
+        if ! brew install "$formula" >/dev/null 2>&1; then
+          echo "error: 'brew install $formula' failed; run it yourself to see why." >&2
+          exit 1
+        fi
+      done
+      export HOMEBREW_NO_AUTO_UPDATE=1
+    fi
     ;;
 esac