feat: add Homebrew formula and update workflow for automatic formula …

[stearz]

What type of PR is this?

/kind feature

What this PR does / why we need it:

Adds Homebrew installation support for Kelos, allowing users to install and manage Kelos via:

brew tap kelos-dev/tap
brew install kelos

This improves the installation experience and makes Kelos discoverable through a widely-used package manager.

This PR includes:

• Automated formula updates in GitHub Actions during release workflow
• Platform detection for macOS (Intel/ARM64) and Linux (x86_64/ARM64)
• Installation and version tests

The formula is automatically updated with correct checksums and version on every release, requiring no manual intervention.

Which issue(s) this PR is related to:

Fixes #817

Special notes for your reviewer:

• The GitHub Actions workflow automatically skips duplicate builds when the bot commits formula updates (using if: github.actor != 'kelos-dev[bot]')
• Binaries must be built and checksummed in the release job before the formula update step
• Formula uses placeholders that are replaced at release time with actual checksums
• The update-homebrew-formula.sh script handles downloading checksums from the GitHub release and updating the formula

Does this PR introduce a user-facing change?

Yes - a new installation method.

Add Homebrew installation support: users can now install Kelos via `brew tap kelos-dev/tap && brew install kelos`


<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Adds Homebrew support so users can install `kelos` with `brew tap`/`install`. The formula auto-updates on tagged releases and supports macOS (Intel/ARM) and Linux (AMD64/ARM64).

- New Features
  - Added `Formula/kelos.rb` with per-OS/arch binaries; version and checksums are injected at release; includes a `kelos version` test.
  - Release workflow updates the tap on tags: checks out `kelos-dev/homebrew-tap` with `TAP_GITHUB_TOKEN`, copies the formula, runs `hack/update-homebrew-formula.sh "$VERSION" <tap-path>` (with `GH_TOKEN`), then commits/pushes as `kelos-dev[bot]`; bot-triggered runs are skipped.
  - The script downloads `checksums.txt` to `/tmp`, validates `darwin-{amd64,arm64}` and `linux-{amd64,arm64}`, and updates the formula in place.
  - README adds brew steps: `brew tap kelos-dev/kelos && brew install kelos`.

<sup>Written for commit 3fb771cb22675376f3b81d08f8d5068d280a751e. Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

[cubic-dev-ai]

2 issues found across 4 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="hack/update-homebrew-formula.sh">

<violation number="1" location="hack/update-homebrew-formula.sh:15">
P2: The script downloads a release asset named `checksums.txt` but then reads `/tmp/kelos-checksums.txt`. Since the checksums file generated by the release process is `checksums.txt`, the parsing loop will fail when the file isn’t renamed. This will abort the formula update.</violation>
</file>

<file name=".github/workflows/release.yaml">

<violation number="1" location=".github/workflows/release.yaml:99">
P2: Release workflow pushes from a detached HEAD on tag builds; `git push` will fail or not update main, so the Homebrew formula update won’t land.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

1 issue found across 2 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/release.yaml">

<violation number="1" location=".github/workflows/release.yaml:99">
P1: Tag-triggered workflow may fail to push formula updates because `git push origin main` requires a local `main` ref that is not guaranteed in tag checkout context.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[stearz]

I fixed a conflict and squashed the commits. Ready to review

[stearz]

Alright, fixed verify issues and amended the the commit. NOW it is ready for review and merge.

Beware that this PR needs to be merged before so the tap repo is as expected: kelos-dev/homebrew-tap#1

Additionally you need to set up a PAT that is allowed to make changes to the tap repo and give it to the kelos repo as a TAP_GITHUB_TOKEN secret:

  Setting up the TAP_GITHUB_TOKEN secret

  The release workflow automatically updates the Homebrew formula in kelos-dev/homebrew-tap after each release. To
  enable this, a Personal Access Token (PAT) with write access to the tap repository must be configured as a secret
  in the main kelos-dev/kelos repository.

  1. Create the PAT

  Go to github.com/settings/personal-access-tokens/new and create a fine-grained PAT with the following settings:

  - Resource owner: kelos-dev
  - Repository access: Only select repositories → kelos-dev/homebrew-tap
  - Permissions → Contents: Read and write

  2. Add the secret to the kelos repository

  Go to kelos-dev/kelos → Settings → Secrets and variables → Actions → New repository secret and add:

  - Name: TAP_GITHUB_TOKEN
  - Value: the PAT from step 1

  Once set, the release workflow will automatically clone the tap repository, update Formula/kelos.rb with the new
  version and checksums, and push the commit on every tagged release.

It would be more elegant if we would use goreleaser but that would require more work because it would interfer with your existing build and release notes automation. I therfor decided to not go that way.

Hope to be able to install and especially update (that's the bigger value) kelos with homebrew soon.