feat(release): publish signed Homebrew casks

[jmgilman]

Summary

• opt the repository release into Quill-backed Darwin signing and Apple notarization
• carry a formatted GoReleaser cask in the authoritative artifact and publish it through a protected tap PR after the public GitHub Release
• preserve disabled, credential-free defaults for external producer callers

Trust boundaries

• enabled signing requires the complete five-secret credential set before staging
• the Homebrew publisher verifies the artifact handoff and signed release bundle before minting a tap-scoped App token
• the cask stays outside checksums and GitHub Release assets; tap publication never merges or enables auto-merge

Verification

• mise exec -- moon run root:check --summary minimal
• GoReleaser configuration check and credential-free producer/consumer snapshots
• Apple accepted both arm64 and amd64 Darwin submissions; an invalid key failed before any archive was written
• a quarantined Homebrew cask installed and ran on Apple silicon without removing com.apple.quarantine; the notarized amd64 archive also passed strict signature verification and ran through Rosetta
• the Release App opened meigma/homebrew-tap#5; managed cask style, audit, install, and uninstall checks passed on macOS 26 and Ubuntu 24.04
• the first unformatted hand-written fixture in tap PR docs(agents): adopt template-go engineering rules #4 correctly failed cask style; the producer's formatted shape passed in PR feat(cli): stage Go release artifacts #5
• disabled signing and Homebrew paths required no Apple or tap credentials and produced no tap mutation
• disposable rehearsal workflow and tap branches removed after evidence capture