fix: harden CLI installer privilege boundary

Remove the same-user mutable temporary script from the macOS CLI installer privilege boundary.

The installer now passes the bundled helper path to AppleScript as an argument, quotes it inside AppleScript, and builds the privileged symlink command in memory before invoking `bash -c` with administrator privileges. Existing symlink targets are preserved: `/usr/local/bin/codexbar` and `/opt/homebrew/bin/codexbar`.

Proof:
- bash -n bin/install-codexbar-cli.sh
- extracted AppleScript heredoc compiles with osacompile
- static checks confirmed mktemp/install_script/bash temp-file handoff removed
- git diff --check
- make check
- autoreview clean
- CI green on PR head 6b329567

bin/install-codexbar-cli.sh

@@ -10,23 +10,20 @@ if [[ ! -x "$HELPER" ]]; then
   exit 1
 fi
 
-install_script=$(mktemp)
-cat > "$install_script" <<'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
-HELPER="__HELPER__"
-TARGETS=("/usr/local/bin/codexbar" "/opt/homebrew/bin/codexbar")
+osascript - "$HELPER" <<'APPLESCRIPT'
+on run argv
+  set helperPath to item 1 of argv
+  set installCommand to "set -euo pipefail" & linefeed & ¬
+    "HELPER=" & quoted form of helperPath & linefeed & ¬
+    "TARGETS=(\"/usr/local/bin/codexbar\" \"/opt/homebrew/bin/codexbar\")" & linefeed & ¬
+    "for t in \"${TARGETS[@]}\"; do" & linefeed & ¬
+    "  mkdir -p \"$(dirname \"$t\")\"" & linefeed & ¬
+    "  ln -sf \"$HELPER\" \"$t\"" & linefeed & ¬
+    "  echo \"Linked $t -> $HELPER\"" & linefeed & ¬
+    "done"
 
-for t in "${TARGETS[@]}"; do
-  mkdir -p "$(dirname "$t")"
-  ln -sf "$HELPER" "$t"
-  echo "Linked $t -> $HELPER"
-done
-EOF
-
-perl -pi -e "s#__HELPER__#$HELPER#g" "$install_script"
-
-osascript -e "do shell script \"bash '$install_script'\" with administrator privileges"
-rm -f "$install_script"
+  do shell script "bash -c " & quoted form of installCommand with administrator privileges
+end run
+APPLESCRIPT
 
 echo "CodexBar CLI installed. Try: codexbar usage"