docs+ci(macos): ad-hoc sign bundle, add Homebrew cask, clarify install

- release.yml: ad-hoc codesign the .app before packaging so a quarantined
  download avoids the "app is damaged" Gatekeeper verdict; emit the cask
  version + sha256 to the job summary each release for easy tap bumps.
- packaging/homebrew: Homebrew cask + tap/usage notes; install via
  --no-quarantine (the actual Gatekeeper bypass for an unsigned app).
- README: split macOS install into Homebrew and manual .dmg paths with
  the xattr / Settings "Open Anyway" fallbacks.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packaging/homebrew/README.md

@@ -0,0 +1,36 @@
+# Homebrew cask
+
+[`open-cad-studio.rb`](open-cad-studio.rb) is a [Homebrew Cask](https://docs.brew.sh/Cask-Cookbook)
+for installing the macOS (Apple Silicon) build.
+
+## Install without a tap (directly from this file)
+
+```bash
+brew install --cask --no-quarantine \
+  https://raw.githubusercontent.com/HakanSeven12/OpenCADStudio/main/packaging/homebrew/open-cad-studio.rb
+```
+
+`--no-quarantine` is required: the app is ad-hoc signed but **not** Apple-notarised
+(notarisation needs a paid Apple Developer ID), so without it Gatekeeper still
+blocks the first launch.
+
+## Publishing as a proper tap (recommended)
+
+Create a separate GitHub repo named `homebrew-tap` under the same account, put a
+copy of `open-cad-studio.rb` in its `Casks/` directory, then users can run:
+
+```bash
+brew install --cask --no-quarantine hakanseven12/tap/open-cad-studio
+```
+
+`brew upgrade` then keeps the app current automatically.
+
+## Updating for a new release
+
+Each release run prints the new `version` + `sha256` in the GitHub Actions job
+summary (the **Emit Homebrew cask sha256** step). Paste those two lines into the
+cask. To compute the digest manually:
+
+```bash
+shasum -a 256 OpenCADStudio-vX.Y.Z-macos-arm64.dmg
+```

packaging/homebrew/open-cad-studio.rb

@@ -0,0 +1,27 @@
+cask "open-cad-studio" do
+  version "0.4.8"
+  sha256 "8fa92be6045c57ac1994bd20fbb2def7269e25c327b7e62cb59745977c66f421"
+
+  url "https://github.com/HakanSeven12/OpenCADStudio/releases/download/v#{version}/OpenCADStudio-v#{version}-macos-arm64.dmg",
+      verified: "github.com/HakanSeven12/OpenCADStudio/"
+  name "Open CAD Studio"
+  desc "CAD application for 2D drafting and 3D modeling that reads/writes DWG and DXF"
+  homepage "https://github.com/HakanSeven12/OpenCADStudio"
+
+  # Only an Apple Silicon (arm64) build is published.
+  depends_on arch: :arm64
+
+  app "OpenCADStudio.app"
+
+  # The app is ad-hoc signed but not notarised (no paid Apple Developer ID).
+  # Install with `--no-quarantine` so Gatekeeper does not block first launch:
+  #   brew install --cask --no-quarantine packaging/homebrew/open-cad-studio.rb
+  # or, once published to a tap:
+  #   brew install --cask --no-quarantine hakanseven12/tap/open-cad-studio
+
+  zap trash: [
+    "~/Library/Application Support/OpenCADStudio",
+    "~/Library/Preferences/io.github.HakanSeven12.OpenCadStudio.plist",
+    "~/Library/Saved Application State/io.github.HakanSeven12.OpenCadStudio.savedState",
+  ]
+end