fix(uninstall): harden uninstall flow and fail closed

[dan-snelson]

fix(uninstall): harden uninstall flow and fail closed

Refactor scripts/uninstall.sh to make the uninstall path safe for
production use and resilient to partial failures.

The previous implementation could continue after a failed
security authorizationdb read, because shell redirection created the
temporary file even when the command itself failed. That made it
possible to remove the Bootstrap Buddy bundle while leaving the
authorization database entry behind, which is not a safe uninstall
outcome.

This change hardens the script by:

• enabling strict shell behavior with set -euo pipefail
• requiring root execution up front
• using a dedicated temporary workspace with cleanup on exit
• validating that authorization DB reads succeed, produce content, and
  return a valid plist
• checking whether the Bootstrap Buddy mechanism is present before
  attempting teardown
• preferring the bundled teardown script, but falling back to an
  internal teardown path when needed
• verifying that the authorization DB entry is actually gone before
  removing the bundle
• making bundle removal and receipt forgetting idempotent when the
  system is already partially uninstalled
• failing with explicit errors instead of printing success after a
  partial or inconsistent uninstall

The result is an uninstall flow that is safer to run from MDM or manual
recovery workflows and less likely to leave the loginwindow
authorization database in a broken state.

[Copilot]

Pull request overview

Hardens the macOS scripts/uninstall.sh flow to fail closed and avoid leaving the system in an inconsistent state (e.g., bundle removed while the loginwindow authorization DB entry remains).

Changes:

• Enables strict shell behavior (set -euo pipefail) and requires root execution up front.
• Uses a temporary workspace with cleanup, validates authorizationdb read output (non-empty + valid plist), and verifies removal before deleting the bundle.
• Prefers the bundled teardown script with a fallback to an internal teardown path; makes bundle/receipt removal idempotent.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.