fix(ci): use portable fallbacks for bash-4 builtins and GNU sed in hook scripts

[jiengup]

Closes #3693

Rationale

Several hook scripts use mapfile (bash >= 4) and sed -i without backup extension (GNU extension). On macOS stock bash 3.2 and BSD sed, these fail, blocking contributors from committing.

What changed

• mapfile calls now guard with command -v mapfile and fall back to a while IFS= read -r loop.
• sed -i calls is replaced by the sed -i.bak && rm pattern already established in trailing-whitespace.sh.

Local Execution

• prek run -a

[github-actions]

Thanks for the PR. It is labeled S-waiting-on-review and queued for review.

Slash commands (own line, regular comment) move it around the queue:

• /ready - back to S-waiting-on-review after addressing feedback
• /author - flip to S-waiting-on-author while you finish changes
• /request-review @user-or-team - request a reviewer

See CONTRIBUTING.md for details.

[hubcio]

the -i.bak switch itself is the right call and matches the trailing-whitespace.sh precedent. main ask is the && rm -f chaining - it quietly replaces the old loud sed failure with a false "Fixed" + exit 0 (details in the line comments).

two findings sit on lines outside this diff, so noting them here:

• scripts/verify-crates-publish.sh:313 - lc="${crate,,}" is bash-4-only, stock macOS bash 3.2 dies with bad substitution, and it fails late (after all four crates already published to the local registry). it's also a no-op since the crate names are already lowercase, so lc="$crate" fixes it for free.
• scripts/ci/python-sdk-version-sync.sh:144 - sort -V is GNU coreutils-only, BSD sort rejects it. the --fix path hits it exactly when the two versions differ, i.e. the case the hook exists for. worth confirming on an actual mac.

with a\, \b and these two still around, #3693 ends up only partially closed for macos contributors - either keep the issue open or note a follow-up in the PR.

[hubcio]

-i.bak now creates Cargo.toml.bak, but cleanup() only restores Cargo.toml from the mktemp snapshot - it never removes the .bak. if sed fails (the && skips the rm and the sanity check below exits 1) or a ctrl-c lands between sed and rm, Cargo.toml.bak survives the trap, which breaks the "leave the working tree untouched on exit, even on failure" contract at the top of this file. *.bak isn't gitignored either. one rm -f Cargo.toml.bak inside the CARGO_TOML_PATCHED branch of cleanup() covers all paths. the && itself is fine here - the sanity check right below fails closed.