feat(release): plumb-dev/homebrew-tap + cargo-dist wiring

[aram-devdocs]

Summary

Create the plumb-dev/homebrew-tap repo, configure cargo-dist
to publish a formula on every release, and verify brew install plumb-dev/tap/plumb works on macOS + Linux.

Crate / area

release — release artifacts (cargo-dist, release-please, installers)

Phase / batch

Part of #49 → Batch 5A (Registries + tap infra).

Effort: M

PRD references

• PRD §15.1

Acceptance criteria

• Homebrew tap repo exists with automated formula updates.
• brew install plumb-dev/tap/plumb installs on macOS arm64 + x86_64 and Linux.
• cargo-dist tap field uncommented in dist-workspace.toml.

Dependencies

• None (first in batch; batch-level deps gate this).

Review gates

• 02-spec-reviewer
• 03-code-quality-reviewer
• 05-architecture-validator
• 04-test-runner

How to deliver

Dispatch /gh-issue <this-issue-number>. See the root AGENTS.md and the scoped release/AGENTS.md for the invariants that apply.

Suggested delivery: gh-issue

[aram-devdocs]

Evidence update from PR #200: #200

This change adds repo-owned validation and documentation proving the current non-manual release/install channel contract:

• bash tests/install-smoke-validate.sh passes
• bash tests/release-security-validate.sh passes
• bash tests/release-readiness-matrix-validate.sh passes
• git diff --check passes

What this PR does for #51:

• keeps Homebrew explicitly gated/prep-only in install-smoke.yml, release.yml, dist-workspace.toml, and the v0 release-readiness runbook
• strengthens validator coverage so cargo and curl are the only active non-manual channels while brew remains gated
• updates stale readiness wording around chore(main): release 0.0.2 #101 without treating feat(release): plumb-dev/homebrew-tap + cargo-dist wiring #51 as complete

#51 remains open. This PR does not create the plumb-dev/homebrew-tap repo, does not uncomment tap, does not add publish secrets/permissions, and does not verify a live brew install plumb-dev/tap/plumb path.