[codeforester]

Summary

Adds the local macOS install-matrix harness for the four fixed validation cells: source/Homebrew routes crossed with Bash/Zsh shells.

The change includes:

• a guarded administrator setup script with --dry-run and --remove, idempotent state capture, scoped sudoers, and shell restoration;
• bin/base-matrix, a schema-backed scenario runner that uses non-interactive sudo -n -u <matrix-account> -i, refuses non-matrix users, records the Base commit and host/cell metadata, and redacts persisted output;
• the scenario/result schemas, a trivial fixture, BATS coverage for the admin lifecycle, and user/operator documentation; and
• the corresponding .ai-context command, workflow, and status updates.

Issue

Refs #2559

Validation

• env -u BASE_HOME BASE_TEST_PYTHON=/Users/rameshhp/.base.d/base/.venv/bin/python BASE_BASH_LIBS_DIR=/Users/rameshhp/work/base-bash-libs/lib/bash BASE_CLI_SOURCE_DIR=/Users/rameshhp/work/base-cli/lib/python ./bin/base-test --python-only — 1,835 Python tests and 1,061 BATS tests passed.
• /Users/rameshhp/.base.d/base/.venv/bin/python -m pytest -q cli/python/base_matrix/tests/test_runner.py — 6 passed.
• /Users/rameshhp/.base.d/base/.venv/bin/python -m pylint --rcfile=.pylintrc cli/python/base_matrix — clean.
• shellcheck tools/macos_matrix_admin.sh bin/base-matrix — clean.
• bash -n tools/macos_matrix_admin.sh bin/base-matrix and git diff --check — passed.

Demo Impact

None. This is local validation tooling and documentation; no product demo behavior changes.

Notes

• The real four-cell host validation remains intentionally maintainer-run. Review ./tools/macos_matrix_admin.sh --dry-run, then apply it with sudo and run ./bin/base-matrix run --scenario tests/fixtures/macos_matrix/trivial.json --cells all on the prepared macOS host. That machine mutation was not performed in this worktree.
• Keep the generated result JSON and exact host context with the implementation evidence; do not publish private account paths, credentials, or unredacted logs.
• The issue should remain open until the maintainer-run matrix evidence is attached and reviewed.