feat(ci): add managed Homebrew tap validation

[jmgilman]

Summary

• add a secret-free reusable workflow for cask pull requests
• discover added or modified Casks/*.rb files and reject unsupported paths or deletions
• validate each changed cask on macOS and Ubuntu with style, audit, install, and uninstall checks
• expose stable casks / Homebrew cask validation status for tap branch protection

Rehearsal

• passing caller PR: test(ci): exercise managed tap validation homebrew-release-rehearsal#2
• intentional checksum failure: test(ci): reject invalid cask checksum homebrew-release-rehearsal#3
• the negative rehearsal failed on macOS with the expected SHA-256 mismatch; Ubuntu passed because that platform checksum was unchanged

Validation

• actionlint .github/workflows/homebrew-tap-ci.yml
• git diff --check
• mise exec -- moon run root:check --summary minimal
• live reusable-workflow calls from a separate public tap repository on macOS 26 and Ubuntu 24.04