feat(lh-115196): improve SCCFM plugin setup and safety

INSTALL.md

@@ -53,6 +53,25 @@ isolated while exposing `sccfm-cli` and `sccfm-cli-interactive` on your `PATH`.
 pipx install cisco-sccfm-devkit
 ```
 
+For an explicitly requested CLI-only installation on macOS or Linux, Homebrew
+is also supported:
+
+```bash
+brew tap CiscoDevNet/tap
+brew trust --formula CiscoDevNet/tap/sccfm-cli  # required once on Homebrew 6.0+
+brew install CiscoDevNet/tap/sccfm-cli
+```
+
+Homebrew releases earlier than 6.0 do not provide `brew trust`; omit that line
+there. Formula-specific trust avoids trusting every current and future item in
+the third-party tap.
+
+The Homebrew formula installs the CLI and Python library, but not the
+`cisco.sccfm` Ansible collection by itself. The agent plugin's setup skill can
+keep this CLI and add a private, version-matched Ansible companion under
+`~/.sccfm-agent-plugin/ansible-runtime`; that directory is not added to `PATH`,
+so the Homebrew CLI remains authoritative.
+
 ### Install with pip
 
 Use `pip` when you are installing into an existing virtual environment:

README.md

@@ -217,6 +217,22 @@ keeps the CLI isolated while exposing `sccfm-cli` and `sccfm-cli-interactive` on
 pipx install cisco-sccfm-devkit
 ```
 
+Homebrew remains available as an optional CLI-only install on macOS and Linux:
+
+```bash
+brew tap CiscoDevNet/tap
+brew trust --formula CiscoDevNet/tap/sccfm-cli  # required once on Homebrew 6.0+
+brew install CiscoDevNet/tap/sccfm-cli
+```
+
+Omit `brew trust` on Homebrew releases earlier than 6.0. Formula-specific trust
+avoids trusting every current and future item in the third-party tap.
+
+Homebrew does not install the `cisco.sccfm` Ansible collection by itself. The
+agent plugin's setup skill can preserve the Homebrew CLI and add a private,
+version-matched Ansible companion without exposing another `sccfm-cli` on
+`PATH`.
+
 Installing into a virtual environment with `pip` is also supported:
 
 ```bash

cisco_sccfm_cli/commands/tests/test_sccfm_cli_skill.py

@@ -52,7 +52,7 @@ def test_cisco_sccfm_cli_skill_should_cover_schema_driven_operation() -> None:
         "Class B",
         "Class C",
         "EXECUTE <exact shell command>",
-        "SCCFM_APPROVAL_COMMAND: <exact shell command>",
+        "Do not emit a separate machine-readable marker",
         "Match User Intent Conservatively",
         "schema export",
         "not validated against live state",
@@ -79,6 +79,7 @@ def test_cisco_sccfm_cli_skill_should_cover_schema_driven_operation() -> None:
 
     for fragment in expected_fragments:
         assert fragment in body
+    assert "SCCFM_APPROVAL_COMMAND:" not in body
 
     assert "sccfm-cli-interactive" in body
     assert "SCCFM_API_TOKEN" not in body