Supply real GNU timeout to native macOS guidance checks

Both macOS native jobs fail the copied temperature recipes before reading any sensor. Install coreutils into the workflow PATH and verify GNU timeout for every Unix runner. Exercise the actual workflow snippets with real GNU timeout and fail-closed install, missing-tool and unsupported-tool controls; leave the recipes and their TERM/KILL/privacy controls unchanged.

Contract-Neutral: Native CI prerequisite and its fixture coverage only; no installer, runtime, API, permission or diagnostic contract changes.
Change-source: pulse-maintainer

.github/workflows/unified-agent-native.yml

@@ -84,6 +84,24 @@ jobs:
           go-version-file: go.mod
           cache: true
 
+      - name: Supply GNU timeout for macOS guidance checks
+        if: runner.os == 'macOS'
+        shell: bash
+        run: |
+          set -euo pipefail
+          brew install coreutils
+          coreutils_bin="$(brew --prefix coreutils)/libexec/gnubin"
+          test -x "$coreutils_bin/timeout"
+          "$coreutils_bin/timeout" --version | grep -q 'GNU coreutils'
+          printf '%s\n' "$coreutils_bin" >> "$GITHUB_PATH"
+
+      - name: Verify native Unix timeout prerequisite
+        if: matrix.unix
+        shell: bash
+        run: |
+          set -euo pipefail
+          timeout --version | grep -q 'GNU coreutils'
+
       - name: Test native agent runtime
         run: >-
           go test