Ad-hoc codesign macOS binaries + update README + cask version fix

- Add codesign --sign - step for macOS builds to prevent Gatekeeper blocks
- Add version :latest to Homebrew cask
- Update README to note Homebrew cask is macOS-only

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: HavenDV

.github/ttok.rb

@@ -2,6 +2,7 @@
   name "ttok"
   desc "The fastest CLI tool for counting, encoding, decoding, and exploring BPE tokens"
   homepage "https://github.com/tryAGI/Tiktoken"
+  version :latest
 
   arch arm: "osx-arm64", intel: "osx-x64"
 

.github/workflows/native-cli.yml

@@ -117,6 +117,10 @@ jobs:
         run: |
           echo Hello world | src\cli\Tiktoken.Cli\bin\Release\net10.0\${{ matrix.rid }}\publish\Tiktoken.Cli.exe
 
+      - name: Codesign binary (macOS)
+        if: runner.os == 'macOS'
+        run: codesign --sign - --force src/cli/Tiktoken.Cli/bin/Release/net10.0/${{ matrix.rid }}/publish/Tiktoken.Cli
+
       - name: Prepare release binary (Linux/macOS)
         if: runner.os != 'Windows'
         run: |

src/cli/Tiktoken.Cli/README.md

@@ -5,11 +5,12 @@ The fastest .NET CLI tool for counting, encoding, decoding, and exploring BPE to
 ## Install
 
 ```bash
-# Homebrew (macOS/Linux)
+# Homebrew (macOS — always installs latest release)
 brew install tryAGI/tap/ttok
 
 # Shell script (macOS/Linux — auto-detects OS/arch)
 curl -fsSL https://raw.githubusercontent.com/tryAGI/Tiktoken/main/install.sh | sh
+# Recommended for Linux — Homebrew cask is macOS-only
 
 # PowerShell (Windows — auto-detects arch)
 irm https://raw.githubusercontent.com/tryAGI/Tiktoken/main/install.ps1 | iex