fix(ruby/gem): add Ruby to audit and require rbenv before gem update

Problem: gem update failed with apt-managed Ruby
- gem showed as outdated but Ruby wasn't audited
- gem update --system fails on apt-managed Ruby with error:
  "Your RubyGems was installed through APT, and upgrading it through
   RubyGems itself is unsupported"
- No dependency ordering between Ruby and gem

Solution: Add Ruby auditing and enforce rbenv requirement

Changes to cli_audit.py:
- Added Ruby to TOOLS tuple for auditing
- Ruby now shows in audit output (status: UNKNOWN due to version format)
- Processing order: Ruby (order 32) → gem (order 33)

Changes to install_gem.sh:
- Added check_rbenv_ruby() to detect if Ruby is rbenv-managed
- update_gem() now checks and refuses to update apt-managed gem
- Provides clear error message: "Please install Ruby via rbenv first"
- reconcile_gem() automatically installs Ruby via rbenv if needed

Expected workflow:
1. make upgrade → shows Ruby (apt 3.2 → rbenv 3.3.6+)
2. User installs Ruby → removes apt, installs rbenv
3. make upgrade → shows gem (3.4.20 → 3.7.2)
4. User updates gem → gem update --system works (rbenv-managed)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: AI Assistant

cli_audit.py

@@ -807,6 +807,7 @@ class Tool:
     Tool("pnpm", ("pnpm",), "npm", ("pnpm",)),
     Tool("yarn", ("yarn",), "npm", ("yarn",)),
     Tool("composer", ("composer",), "gh", ("composer", "composer")),
+    Tool("ruby", ("ruby",), "gh", ("ruby", "ruby")),
     Tool("gem", ("gem",), "gh", ("rubygems", "rubygems")),
     # 2) Core developer tools and utilities
     Tool("fd", ("fd", "fdfind"), "gh", ("sharkdp", "fd")),

scripts/install_gem.sh

@@ -16,6 +16,23 @@ ensure_rbenv_loaded() {
   fi
 }
 
+check_rbenv_ruby() {
+  ensure_rbenv_loaded
+
+  # Check if Ruby is rbenv-managed
+  local ruby_path
+  ruby_path="$(command -v ruby 2>/dev/null || echo '')"
+
+  case "$ruby_path" in
+    "$HOME/.rbenv/"*)
+      return 0  # rbenv-managed
+      ;;
+    *)
+      return 1  # not rbenv-managed (apt, system, or missing)
+      ;;
+  esac
+}
+
 update_gem() {
   ensure_rbenv_loaded
 
@@ -24,6 +41,16 @@ update_gem() {
     return 1
   fi
 
+  # Check if Ruby is rbenv-managed before trying to update gem
+  if ! check_rbenv_ruby; then
+    echo "[gem] Error: Ruby is not rbenv-managed (currently apt/system)" >&2
+    echo "[gem] Cannot update gem via 'gem update --system' for apt-managed Ruby" >&2
+    echo "[gem] Please install Ruby via rbenv first:" >&2
+    echo "[gem]   make install-ruby" >&2
+    echo "[gem]   or: scripts/install_ruby.sh reconcile" >&2
+    return 1
+  fi
+
   local before after path
   before="$(gem --version 2>/dev/null || echo '<none>')"
 
@@ -58,6 +85,9 @@ reconcile_gem() {
   if ! command -v gem >/dev/null 2>&1; then
     echo "[gem] gem not found. Installing Ruby (which includes gem)..."
     "$DIR/install_ruby.sh" reconcile || true
+  elif ! check_rbenv_ruby; then
+    echo "[gem] Ruby is not rbenv-managed. Installing Ruby via rbenv first..."
+    "$DIR/install_ruby.sh" reconcile || true
   fi
 
   update_gem