feat: install script + Homebrew tap distribution

[Aldiwildan77]

What

Make Aegis easy to install for non-Rust users, on top of the prebuilt binaries already attached to each GitHub Release.

Adds

install.sh — curl | sh installer

• Detects OS/arch (macOS/Linux, amd64/arm64), downloads the matching release asset
• Verifies the SHA256 checksum before installing
• Installs to /usr/local/bin (falls back to ~/.local/bin)
• Env overrides: AEGIS_VERSION, AEGIS_INSTALL_DIR
• Falls back to cargo install aegis-policy for unsupported targets

curl -fsSL https://raw.githubusercontent.com/mocha-bot/aegis/master/install.sh | sh

SHA256 checksums — release workflow now generates a SHA256SUMS file and attaches it to each release (consumed by the install script and Homebrew formula).

Homebrew tap — brew install mocha-bot/tap/aegis

• packaging/homebrew/aegis.rb.tmpl — formula template
• packaging/homebrew/render-formula.sh — fills version + per-asset SHA256 from SHA256SUMS
• New homebrew job in the release workflow renders and pushes the formula to mocha-bot/homebrew-tap on release
• Guarded by the HOMEBREW_TAP_TOKEN secret — job skips cleanly if absent

One-time setup required (see packaging/homebrew/README.md)

1. Create repo mocha-bot/homebrew-tap
2. Create a PAT with contents: write on that repo
3. Add it as HOMEBREW_TAP_TOKEN secret here

Until then, install.sh + checksums work standalone; the Homebrew job no-ops.

Notes

• No Rust code changed — no test impact.
• install.sh and render-formula.sh pass sh -n syntax checks; formula rendering verified locally with sample checksums.