feat(workflows): add macos-cask-release reusable workflow

[JSisques]

Summary

Adds a new reusable workflow, macos-cask-release.yml, that plays the same role for macOS/Homebrew apps that docker-release.yml plays for Docker services in the existing release train: given a channel/version already computed by release-train-detect, it builds the app via the caller's own packaging script, tags, publishes a GitHub Release with the built asset, and — on the stable channel only — renders a Homebrew Cask from the caller's template and pushes it to a tap repository.

• Channel detection stays in the caller (release-train-detect); this workflow only executes once a release is already decided.
• Tag-only push to the consumer repo (no release commit), so it can never retrigger the caller's own push-triggered workflow.
• Stable-only Cask publish: full-file regeneration from a {{VERSION}}/{{SHA256}}-templated file the caller owns, pushed directly to the tap (no PR gate there — consistent with docker-release.yml's "push directly" philosophy for the release step itself).
• Fails fast if HOMEBREW_TAP_TOKEN is missing on a stable run, before spending any build minutes.
• Re-downloads and checksum-verifies the published Release asset before deriving the Cask's sha256 from it.

First consumer: sisques-labs/portero (companion PR, currently blocked on this one merging since it references @main).

Test plan

• actionlint .github/workflows/macos-cask-release.yml — clean
• Manually cross-checked inputs/secrets/outputs against openspec/changes/homebrew-release-train/design.md's Interfaces/Contracts section in the portero repo
• End-to-end verification happens from the portero companion PR once this merges (pushes to develop/staging/main exercising alpha/beta/stable channels)