Use stable test-bot formulae

- Avoid default test-bot audits depending on `xz`, whose homepage can
  make unrelated CI fail when the upstream site is unreachable.
- Use `libspiro` and `bats-core` because they have reachable GitHub
  homepages, no stable dependencies and cover library and executable
  bottle contents.
- Keep the regression spec on `test_bot` internals so it does not pull
  in the CLI command layer just to check the default formula set.