fix(brew): use valid brew tap trust commands

docs/skills/brew-lifecycle/SKILL.md

@@ -82,7 +82,7 @@ not `system_files/bluefin/preinstall.d/`. See [package-set.md](references/packag
 
 - Suggesting `rpm-ostree install` for any missing tool — this is never correct on Bluefin
 - Adding a package to `preinstall.d/` that has a udev rule, kernel module, D-Bus system service, FUSE driver, firmware, or PAM dependency — it must stay as an RPM
-- Adding a tap without `trusted: true` / `--trust` (Homebrew 6.0 blocks untrusted taps silently)
+- Adding a tap without `trusted: true` in Brewfiles or a following `brew trust` command in recipes (Homebrew 6.0 blocks untrusted taps silently)
 - Bumping a version number or manual stamp to "trigger" a brew-preinstall re-run — the service is content-addressed; edit the Brewfile and the hash change triggers it automatically
 - Editing `preinstall.d/` in a downstream repo (bluefin, bluefin-lts, dakota) for packages that should live in `common` — common ships to all variants
 - Assuming `brew-preinstall.service` ran successfully because it's enabled — the service exits 0 silently if brew is not yet installed; check `journalctl --user -u brew-preinstall.service`

docs/skills/brew-lifecycle/references/placement-rules.md

@@ -59,9 +59,11 @@ Antigravity, Zed, Cursor, framework_tool, asusctl-linux.
 **In just recipes** that call `brew tap` before cask installs:
 ```diff
 - brew tap ublue-os/tap 2>/dev/null || true
-+ brew tap --trust ublue-os/tap
++ brew tap ublue-os/tap 2>/dev/null || true
++ brew trust ublue-os/tap 2>/dev/null || true
 ```
-The `|| true` silencer must be removed — tap failures should surface.
+Keep the existing error handling for each recipe; `brew trust` is a separate
+command and must run after the tap succeeds.
 
 **In Brewfiles** that declare taps (Homebrew 6.0 Brewfile-native syntax):
 ```ruby
@@ -70,16 +72,16 @@ tap "ublue-os/experimental-tap", trusted: true
 ```
 
 **Do not use `HOMEBREW_TRUSTED_TAPS` env var** — this was a Homebrew 4.x
-mechanism. The correct 6.0 approach is `--trust` at tap-time and
-`trusted: true` in Brewfiles.
+mechanism. The correct 6.0 approach is `brew tap` followed by `brew trust`,
+or `trusted: true` in Brewfiles.
 
 ### Known trust issues in the codebase (as of 2026-06)
 
 | File | Current code | Status |
 |---|---|---|
-| `system.just` dx recipe | `brew tap --trust ublue-os/tap` | ✅ correct |
-| `system.just` dx recipe | `brew tap --trust ublue-os/experimental-tap` | ✅ correct |
-| `apps.just` install-jetbrains-toolbox | `brew tap ublue-os/homebrew-tap` | ❌ wrong tap name + no `--trust` |
+| `system.just` dx recipe | `brew tap` + `brew trust` | ✅ correct |
+| `system.just` dx recipe | `brew tap` + `brew trust` | ✅ correct |
+| `apps.just` install-jetbrains-toolbox | `brew tap` + `brew trust` | ✅ correct |
 | `apps.just` bbrew recipe | `brew install Valkyrie00/homebrew-bbrew/bbrew` | ❌ 3rd-party tap, no trust |
 
 Ref: https://brew.sh/2026/06/11/homebrew-6.0.0/

docs/skills/oem-hardware-hooks/references/oem-brew.md

@@ -124,4 +124,4 @@ the file and repeated logins safely refresh it.
 ## Known gaps (tracking issues)
 
 - `20-framework.sh` in `projectbluefin/bluefin` is superseded by `20-oem-brew.sh` in common — file a cleanup issue in bluefin to delete it after common ships.
-- `apps.just` ASUS recipe still calls `brew install --cask` directly without `--trust`; update to use Brewfile or `--trust` flag.
+- `apps.just` ASUS recipe still calls `brew install --cask` directly; update to use Brewfile or pair `brew tap` with `brew trust`.

system_files/bluefin/usr/libexec/bazaar-hook

@@ -31,7 +31,7 @@ def spawn_brew(app):
     brew = '/home/linuxbrew/.linuxbrew/bin/brew'
     spawn_and_detach([
         'flatpak-spawn', '--host', 'xdg-terminal-exec', '-x',
-        'bash', '-c', f'{brew} tap --trust ublue-os/tap && {brew} install --cask {app}'
+        'bash', '-c', f'{brew} tap ublue-os/tap && {brew} trust ublue-os/tap && {brew} install --cask {app}'
     ])
 
 def handle_jetbrains():

system_files/bluefin/usr/share/ublue-os/just/system.just

@@ -146,10 +146,12 @@ toggle-devmode:
 
     # Taps are silent/fast — run before the progress bar
     if _dx_wants -E "VS Code|VSCodium|Antigravity|JetBrains"; then
-        brew tap --trust ublue-os/tap
+        brew tap ublue-os/tap
+        brew trust ublue-os/tap
     fi
     if _dx_wants "Zed"; then
-        brew tap --trust ublue-os/experimental-tap
+        brew tap ublue-os/experimental-tap
+        brew trust ublue-os/experimental-tap
     fi
 
     # Build install queue for the progress bar

system_files/shared/usr/share/ublue-os/just/apps.just

@@ -9,7 +9,8 @@ jetbrains-toolbox:
 [group('Apps')]
 install-jetbrains-toolbox:
     #!/usr/bin/env bash
-    brew tap --trust ublue-os/tap
+    brew tap ublue-os/tap
+    brew trust ublue-os/tap
     brew install --cask ublue-os/tap/jetbrains-toolbox-linux
 
 # Install OpenTabletDriver, an open source, cross-platform, user-mode tablet driver
@@ -60,7 +61,8 @@ install-asus:
     #!/usr/bin/env bash
     set -euo pipefail
     echo "Installing ASUS laptop tools..."
-    brew tap --trust ublue-os/tap
+    brew tap ublue-os/tap
+    brew trust ublue-os/tap
     brew install --cask ublue-os/tap/asusctl-linux
     brew install --cask ublue-os/tap/rog-control-center-linux
     echo ""