ci: orchestrate release-please with brew tap update

[EndersonPro]

Summary

• integrate Homebrew tap publication into the same release-please run when a release is actually created
• convert release-brew.yml into manual recovery-only fallback to prevent duplicate tap pushes during transition
• add release contract coverage for the new orchestration and fallback behavior
• update release runbook documentation for the new operational flow

Validation

• bash scripts/check_version_contract.sh --tag v0.9.2
• ARCH=arm64 bash scripts/package_macos.sh contract
• go test ./integration -run "TestReleasePleaseWorkflowOrchestratesBrewPublish|TestFallbackReleaseWorkflowIsManualAndRecoveryOnly|TestVersionContractScriptsAndReleasePleaseConfigExist|TestVersionContractJobRunsInPRWorkflow"
• go test ./integration

Follow-up in CI

• actionlint was not available locally (command not found), so workflow linting should be verified in CI.
• final operational validation requires a real GitHub Actions release execution.