ci: sync verified Headless releases

[SarthakWade]

Summary

• poll the latest public Headless release and support exact manual version dispatches
• verify the release checksum manifest, Developer ID signature, hardened runtime, universal architectures, stapled notarization ticket, and Gatekeeper assessment
• render and style a checksum-pinned cask before committing it with the repository-scoped workflow token
• document the canonical Homebrew install command

The existing v1.0.2 release is intentionally rejected and no cask is created because it predates the signed release contract and checksum manifest.