docs+ci(macos): ad-hoc sign bundle, add Homebrew cask, clarify install

- release.yml: ad-hoc codesign the .app before packaging so a quarantined
  download avoids the "app is damaged" Gatekeeper verdict; emit the cask
  version + sha256 to the job summary each release for easy tap bumps.
- packaging/homebrew: Homebrew cask + tap/usage notes; install via
  --no-quarantine (the actual Gatekeeper bypass for an unsigned app).
- README: split macOS install into Homebrew and manual .dmg paths with
  the xattr / Settings "Open Anyway" fallbacks.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/release.yml

@@ -188,6 +188,17 @@ jobs:
           [ -z "$VERSION" ] && VERSION="0.0.0"
           sed "s/__VERSION__/$VERSION/g" packaging/Info.plist > "$APP/Contents/Info.plist"
 
+      - name: Ad-hoc code-sign the bundle
+        run: |
+          # No paid Apple Developer ID is available, so the app cannot be
+          # notarised. An *ad-hoc* signature (identity "-") at least gives the
+          # bundle a valid self-signature: this avoids the harshest Gatekeeper
+          # verdict ("app is damaged, Move to Trash") on a quarantined download
+          # and is mandatory anyway for arm64 binaries to execute. Sign the
+          # whole bundle deeply, then verify.
+          codesign --force --deep --sign - --timestamp=none OpenCADStudio.app
+          codesign --verify --strict --verbose=2 OpenCADStudio.app
+
       - name: Create .dmg
         run: |
           hdiutil create \
@@ -203,3 +214,22 @@ jobs:
         run: |
           mv OpenCADStudio.dmg OpenCADStudio-${{ github.ref_name }}-macos-arm64.dmg
           gh release upload ${{ github.ref_name }} OpenCADStudio-${{ github.ref_name }}-macos-arm64.dmg --clobber --repo ${{ github.repository }}
+
+      - name: Emit Homebrew cask sha256
+        if: github.event_name == 'release'
+        run: |
+          # Print the values needed to bump the Homebrew cask
+          # (packaging/homebrew/open-cad-studio.rb) for this release, so the
+          # tap can be updated with a copy-paste instead of computing the
+          # digest by hand.
+          VERSION="${{ github.ref_name }}"
+          VERSION="${VERSION#v}"
+          SHA=$(shasum -a 256 OpenCADStudio-${{ github.ref_name }}-macos-arm64.dmg | awk '{print $1}')
+          {
+            echo "## Homebrew cask bump"
+            echo "Update \`packaging/homebrew/open-cad-studio.rb\`:"
+            echo '```ruby'
+            echo "  version \"$VERSION\""
+            echo "  sha256 \"$SHA\""
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"