attestation: remove `T.must`

This updates `ensure_executable!` return to drop nil and uses the
`with_env` return so that Sorbet can infer the type.

Also search all guesses for `ensure_executable!` prior to installing
formula.