feat(cli): publish Homebrew casks through tap PRs

[jmgilman]

Summary

• add release-cli publish homebrew for generated GoReleaser casks
• reconcile protected tap branches and pull requests through a fail-closed state machine
• add a go-github tap adapter, generated mocks, behavior tests, and CLI reference documentation

Trust boundaries

• never write the tap default branch, force-update, delete, auto-merge, or merge
• accept a publication commit only when its sole parent is the observed base and it changes exactly the expected cask
• read fresh remote state after ambiguous writes before retrying

Verification

• mise exec -- moon run root:check --summary minimal
• live disposable publication against meigma/homebrew-release-rehearsal: created PR docs(agents): adopt template-go engineering rules #4, rerun returned open, Validate cask and Kusari Inspector passed; PR closed and branch deleted afterward