fix: resolve two macOS-only test/script failures in unit suite (#8577)

bin/restore-policies.sh used readarray (bash 4+), which fails on macOS
bash 3.2. Replace with a compatible while-read loop.

machineId.test.ts disableWindowsRegistryStrategy() did not neutralize
the macOS ioreg strategy, so mocked os.hostname() was never reached
on macOS and both ladder tests failed. Stub execSync for ioreg commands
so the fallback chain reaches os.hostname() as intended.

Production src/shared/utils/machineId.ts is correct and unchanged.

bin/restore-policies.sh

@@ -39,7 +39,8 @@ snap="$(ops_find_snapshot "$ID")"
 
 # Policy definition tables present in BOTH the snapshot and the live DB. GLOB
 # keeps `_` literal; we drop usage counters / logs so accounting isn't rewound.
-readarray -t tables < <(
+tables=()
+while IFS= read -r t; do tables+=("$t"); done < <(
   sqlite3 "$snap/storage.sqlite" \
     "SELECT name FROM sqlite_master WHERE type='table' AND name GLOB 'api_key*' \
        AND name NOT GLOB '*counter*' AND name NOT GLOB '*_log*' ORDER BY name;"

changelog.d/fixes/8577-fix.plan.md

@@ -0,0 +1,2 @@
+- fix(tests): make machineId tests macOS-compatible by stubbing ioreg in test helper (#8577)
+- fix(scripts): replace bash 4+ readarray with compatible while-read loop in restore-policies.sh (#8577)

tests/unit/shared/machineId.test.ts

@@ -38,6 +38,14 @@ function disableWindowsRegistryStrategy(): () => void {
     return origReadFileSync(filePath, encoding);
   };
 
+  const origExecSync = childProcess.execSync;
+  childProcess.execSync = ((cmd: Parameters<typeof childProcess.execSync>[0], opts: Parameters<typeof childProcess.execSync>[1]) => {
+    if (String(cmd ?? "").includes("ioreg")) {
+      throw new Error("ENOENT: mocked ioreg not available");
+    }
+    return origExecSync(cmd, opts);
+  }) as typeof childProcess.execSync;
+
   return () => {
     if (origSysRoot !== undefined) {
       process.env.SystemRoot = origSysRoot;
@@ -50,6 +58,7 @@ function disableWindowsRegistryStrategy(): () => void {
       delete process.env.windir;
     }
     fs.readFileSync = origReadFileSync;
+    childProcess.execSync = origExecSync;
   };
 }