- release.yml: ad-hoc codesign the .app before packaging so a quarantined
download avoids the "app is damaged" Gatekeeper verdict; emit the cask
version + sha256 to the job summary each release for easy tap bumps.
- packaging/homebrew: Homebrew cask + tap/usage notes; install via
--no-quarantine (the actual Gatekeeper bypass for an unsigned app).
- README: split macOS install into Homebrew and manual .dmg paths with
the xattr / Settings "Open Anyway" fallbacks.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
