ci: add managed cask validation

[jmgilman]

Summary

• call the managed Homebrew tap workflow at immutable merged commit meigma/release@c933580
• restrict the caller token to read-only repository contents
• apply current Homebrew formatting to the existing ghd cask so the integration PR exercises the complete validation path

Validation

• actionlint .github/workflows/casks.yml
• ruby -c Casks/ghd.rb
• git diff --check
• macOS 26 and Ubuntu 24.04 cask style, audit, install, and uninstall checks
• aggregate casks / Homebrew cask validation

After merge, branch protection will require the aggregate check on main.