Define remote installer setup policy

[codeforester]

Summary

• Add a canonical remote installer policy covering Homebrew, Codex CLI, and Claude Code setup paths.
• Enforce structured allowlisted AI profile installer URLs before dry-run or execution.
• Align basectl setup --dry-run Homebrew output with bootstrap/install URL-bearing dry-run output.

Validation

• PYTHONPATH=lib/python:cli/python /Users/rameshhp/.base.d/base/.venv/bin/python -m unittest cli/python/base_dev/tests/test_engine.py
• env -u BASE_HOME -u BASE_PROJECT -u BASE_PROJECT_ROOT -u BASE_PROJECT_MANIFEST -u BASE_PROJECT_VENV_DIR bats cli/bash/commands/basectl/tests/setup.bats
• env -u BASE_HOME ./bin/base-test
• PYTHONPATH=lib/python:cli/python git ls-files -z '*.py' | xargs -0 /Users/rameshhp/.base.d/base/.venv/bin/python -m pylint --rcfile=.pylintrc\n- git diff --check\n- git diff --check --cached\n\nCloses Define remote installer trust policy for setup profiles #513