Homebrew distribution and ad-hoc codesigning

[rianjs]

Sets up Homebrew distribution and ad-hoc codesigning (no Apple Developer ID exists, so this is the best signing available without one).

What's here

• .github/workflows/release.yml — tag-triggered (v*), runs on macos-latest (Apple Silicon):
  1. checks the tag matches tauri.conf.json's version,
  2. builds the Tauri app bundle without the dev-token-store feature (release builds use the encrypted token store),
  3. verifies the ad-hoc signature (codesign --verify --deep --strict),
  4. packages Retune-<version>-aarch64.tar.gz + a .sha256 file,
  5. creates a GitHub release with both assets and the sha256 in the notes.
• tauri.conf.json — bundle.macOS.signingIdentity: "-". Per the Tauri v2 macOS signing docs, the pseudo-identity - produces an ad-hoc signature; putting it in config (rather than the APPLE_SIGNING_IDENTITY env var) means local and CI builds are signed identically with one source of truth.
• scripts/build-install.sh — after building, asserts the bundle carries an ad-hoc signature (Signature=adhoc) and fails loudly if not.
• README — Homebrew install section with the --no-quarantine / not-notarized Gatekeeper caveat.

Why .tar.gz instead of DMG

• Tauri's DMG bundler drives Finder via AppleScript for the drag-to-Applications layout — the slow/flaky step build-install.sh already skips locally, and a known source of CI headaches.
• For a cask, both containers work identically (app "Retune.app" stanza either way), but an unsigned, un-notarized DMG buys nothing: the drag-to-Applications UX is Homebrew's job, and the DMG itself would also be unsigned.
• A tarball is smaller, deterministic to produce, and trivial to checksum.

Verified locally on aarch64: release-shaped build (npx tauri build --bundles app, no dev features) produces a signed bundle:

CodeDirectory v=20500 size=47826 flags=0x10002(adhoc,runtime) hashes=1488+3 location=embedded
Signature=adhoc
TeamIdentifier=not set

codesign --verify --deep --strict passes, and the tarball layout (Retune.app/ at root) matches the prepared cask in open-cli-collective/homebrew-tap.

Rollout sequence (after merge)

1. Push tag v0.1.0 → workflow publishes the release with the real sha256.
2. Fill the sha256 into the prepared Casks/retune.rb in open-cli-collective/homebrew-tap (staged locally, unpushed — it can't land before the release exists because brew audit needs a live URL).
3. Then: brew install --cask --no-quarantine open-cli-collective/tap/retune.