fix(brew): handle root-owned config dir from sudo installs

- Make all post-install setup steps non-fatal using a bestEffort() wrapper
  so Homebrew's post_install never aborts on permission errors
- In tryRepairReadonly(), detect root-owned files (uid 0) and emit a
  targeted message with the actual username instead of falling through
  to the generic warning
- Add ownership detection and repair to `sentry cli fix`:
  - Checks config dir / DB / WAL / SHM file ownership
  - When run as root (sudo sentry cli fix), performs chown to transfer
    ownership back to the real user (inferred from SUDO_USER env var)
  - When not root, prints the exact sudo chown command to run

Author: BYK

AGENTS.md

@@ -77,7 +77,7 @@ Read the full guidelines in `.cursor/rules/bun-cli.mdc`.
 | Write file | `await Bun.write(path, content)` | `fs.writeFileSync()` |
 | Check file exists | `await Bun.file(path).exists()` | `fs.existsSync()` |
 | Spawn process | `Bun.spawn()` | `child_process.spawn()` |
-| Shell commands | `Bun.$\`command\`` | `child_process.exec()` |
+| Shell commands | `Bun.$\`command\`` ⚠️ | `child_process.exec()` |
 | Find executable | `Bun.which("git")` | `which` package |
 | Glob patterns | `new Bun.Glob()` | `glob` / `fast-glob` packages |
 | Sleep | `await Bun.sleep(ms)` | `setTimeout` with Promise |
@@ -89,6 +89,12 @@ import { mkdirSync } from "node:fs";
 mkdirSync(dir, { recursive: true, mode: 0o700 });
 ```
 
+**Exception**: `Bun.$` (shell tagged template) has no shim in `script/node-polyfills.ts` and will crash on the npm/node distribution. Until a shim is added, use `execSync` from `node:child_process` for shell commands that must work in both runtimes:
+```typescript
+import { execSync } from "node:child_process";
+const result = execSync("id -u username", { encoding: "utf-8", stdio: ["pipe", "pipe", "ignore"] });
+```
+
 ## Architecture
 
 ```