ci: migrate goreleaser brews to homebrew_casks (#8)

## Summary
- `brews:` is being phased out by goreleaser ([deprecation
notice](https://goreleaser.com/deprecations/#brews)). The v2.4.0 release
log warned about this.
- Renames the section to `homebrew_casks:`, drops the formula-only
fields (`directory`, `license`, `install`, `test`), and adds a
post-install hook that strips `com.apple.quarantine` so unsigned darwin
binaries actually launch on modern macOS.

## Follow-up (in `abizer/homebrew-tap`)
- Add `tap_migrations.json` mapping `nssh` → cask, and delete the old
`Formula/nssh.rb` so existing `brew upgrade nssh` users land on the
cask.

## Test plan
- [ ] Cut a `patch` release via Actions → release → Run workflow;
confirm goreleaser publishes a cask to `abizer/homebrew-tap` under
`Casks/nssh.rb`
- [ ] `brew install --cask abizer/tap/nssh` on macOS, then `nssh` runs
without the "damaged / cannot be opened" Gatekeeper alert

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Low risk: release packaging config change only, but it can affect
macOS install/upgrade behavior if the tap expects a formula vs cask or
the post-install hook misbehaves.
> 
> **Overview**
> Updates GoReleaser Homebrew publishing from deprecated `brews` to
`homebrew_casks` for `nssh`, removing formula-specific fields
(`directory`, `license`, `install`, `test`).
> 
> Adds a macOS-only post-install hook to strip the
`com.apple.quarantine` xattr from the staged binary so the downloaded
(non-notarized) app can launch without Gatekeeper blocking.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
4c11a84. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: abizer

.goreleaser.yaml

@@ -25,25 +25,27 @@ archives:
 checksum:
   name_template: "checksums.txt"
 
-brews:
+homebrew_casks:
   - name: nssh
     repository:
       owner: abizer
       name: homebrew-tap
       branch: master
       token: "{{ .Env.TAP_TOKEN }}"
-    directory: Formula
     homepage: "https://github.com/abizer/nssh"
     description: "Paste images into Claude Code over SSH"
-    license: "MIT"
     commit_author:
       name: github-actions[bot]
       email: github-actions[bot]@users.noreply.github.com
     commit_msg_template: "nssh {{ .Tag }}"
-    install: |
-      bin.install "nssh"
-    test: |
-      assert_match "usage: nssh", shell_output("#{bin}/nssh 2>&1", 1)
+    # Released binaries aren't notarized; strip the quarantine xattr on install
+    # so macOS doesn't refuse to launch them.
+    hooks:
+      post:
+        install: |
+          if OS.mac?
+            system_command "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "#{staged_path}/nssh"]
+          end
 
 release:
   github: