Avoid Homebrew updates during macOS LLVM provisioning #925

Problem

The macOS amd64 package job in PR #924 times out before compiling Wave. Its release prerequisite runs brew update, whereas the successful build/test lane does not. Updating Homebrew changes the LLVM 21 dependency set and sends this Intel runner into source builds.

Reproduction

Observed at Wave d786655844e1d7571841b20edb318c353b8d1ff0, on the macos-15-intel runner (macOS 15.7.9, image 20260824.0482.1):

python3 -m tools.ci.package --target x86_64-apple-darwin --lane release/package-macos --provision

Failed package job: Homebrew updates to 7.0.9, reports that new bottles are unavailable for the Intel configuration, compiles CMake 4.4.4 for 29 minutes, then reaches Command timeout after 1800.5s: brew during brew install llvm@21 lld@21.

The successful build/test job on the same runner image installs the existing LLVM 21.1.8 and LLD 21.1.8 bottles in 57 seconds without the prerequisite update. These are executed CI observations, not a locally reproduced macOS run.

Scope

Use one consistent macOS LLVM prerequisite for build/test and packaging, including the shared release/nightly package lane. Avoid explicit or automatic Homebrew updates and upgrades during CI provisioning while retaining installation of missing LLVM 21 tools and the existing version checks. Preserve both macOS architectures, package validation, and timeouts.

This does not migrate to another package manager or change the compiler, std, Whale dependency, or supported targets. The fix is being prepared in PR #924.

Completion criteria

• macOS packaging shares the build/test LLVM setup and does not unconditionally run brew update.
• Homebrew provisioning disables automatic metadata updates and upgrades of installed requested formulae, while still installing missing tools and validating LLVM 21.
• Regressions cover both macOS architectures, installation failure propagation, and wrong-major rejection.
• Native macOS package CI passes without extending the prerequisite timeout.