docs: document macOS support and Homebrew distribution

SPEC records the two macOS facts the code bends around (bare-soname
dlopens needing startup-time DYLD paths; the hypervisor entitlement)
and the packaging decisions; README gains the brew install and the
from-source sign step.

README.md

@@ -8,12 +8,30 @@
 
 ### Installation
 
-ecrou is available as a strictly confined snap:
+Linux (strictly confined snap, KVM required):
 ```
 sudo snap install ecrou
 sudo snap connect ecrou:kvm
 ```
 
+macOS (Apple Silicon, Homebrew):
+```
+brew tap vhaudiquet/ecrou https://github.com/vhaudiquet/homebrew-ecrou
+brew install ecrou
+```
+
+The macOS build loads libkrun from the
+[`libkrun/homebrew-krun`](https://github.com/libkrun/homebrew-krun) tap
+at runtime and boots through Hypervisor.framework; the formula signs
+the binary with the hypervisor entitlement macOS requires, so the
+install needs no extra steps. Building from source instead:
+
+```
+brew install libkrun/homebrew-krun/libkrun e2fsprogs
+cargo build --release -p ecrou-cli
+codesign --force --sign - --entitlements packaging/macos/ecrou.entitlements   target/release/ecrou
+```
+
 ### Usage
 
 ```