Refine tap trust warnings

- keep `brew doctor` visibility while moving install-time hints to
  non-fatal preinstall diagnostics
- document why explicit trust matters before the default changes in
  Homebrew 6.0.0 or 5.2.0
- clean untrusted hosted-runner taps before test-bot setup so unrelated
  runner state does not fail `brew doctor`