build: move the entitlements next to the Homebrew formula

All consumers live in packaging already: the formula codesigns at
install, and the CI and release workflows codesign the built binary.
The macOS dir held nothing else.

packaging/homebrew/Formula/ecrou.rb

@@ -3,7 +3,7 @@
 # krunkit comes from, because the engine is dlopen'd from those kegs
 # at runtime.
 class Ecrou < Formula
-  desc "One-shot microVM environments"
+  desc "a small microVM runtime based on libkrun"
   homepage "https://github.com/vhaudiquet/ecrou"
   # Pinned by tag until the first release exists; switch to the
   # release tarball + sha256 then.
@@ -26,14 +26,14 @@ class Ecrou < Formula
     # with the hypervisor entitlement; on current macOS the signature
     # is a hard requirement, the same one krunkit's formula carries.
     system "codesign", "--force", "--sign", "-",
-      "--entitlements", "packaging/macos/ecrou.entitlements", bin/"ecrou"
+      "--entitlements", "packaging/homebrew/ecrou.entitlements", bin/"ecrou"
   end
 
   def caveats
     <<~EOS
       The binary is ad-hoc signed with the com.apple.security.hypervisor
       entitlement. Rebuilding from source (cargo) requires re-signing:
-        codesign --force --sign - --entitlements packaging/macos/ecrou.entitlements target/release/ecrou
+        codesign --force --sign - --entitlements packaging/homebrew/ecrou.entitlements target/release/ecrou
       `ecrou probe` reports this when the entitlement is missing.
     EOS
   end

packaging/homebrew/ecrou.entitlements

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+<key>com.apple.security.hypervisor</key><true/>
+</dict></plist>