fix(release): pin the tap formula to the release tarball

The formula's url pointed at the tag's source archive while its
sha256 came from the darwin tarball — two files, one checksum, so
brew refused every install. The formula now pours the darwin tarball
itself: the release workflow attaches it to the GitHub release, the
tap formula pins that asset's real sha256, and installs stop
compiling rust (the CI-signed entitlement also survives, which a
source build would have stripped).

packaging/homebrew/Formula/ecrou.rb

@@ -11,7 +11,6 @@ class Ecrou < Formula
 
   # libkrun's Hypervisor.framework backend is arm64-only upstream.
   depends_on arch: :arm64
-  depends_on "rust" => :build
   depends_on "libkrun/homebrew-krun/libkrun"
   depends_on "e2fsprogs"
   # A libarchive-capable mke2fs populates ext4 images from tarballs in
@@ -19,13 +18,11 @@ class Ecrou < Formula
   depends_on "libarchive"
 
   def install
-    system "cargo", "build", "--release"
-    bin.install "target/release/ecrou"
-    # Hypervisor.framework grants VM creation only to binaries signed
-    # with the hypervisor entitlement; on current macOS the signature
-    # is a hard requirement, the same one krunkit's formula carries.
-    system "codesign", "--force", "--sign", "-",
-      "--entitlements", "packaging/homebrew/ecrou.entitlements", bin/"ecrou"
+    # CI signed the binary with the hypervisor entitlement (a hard
+    # requirement on current macOS, the same one krunkit's formula
+    # signs for); a rebuild here would strip the signature, so the
+    # release tarball's binary is poured as-is.
+    bin.install "ecrou"
   end
 
   def caveats