docs: the brew tap-trust gate and the macOS from-source section

The one-command install edit had replaced the whole macOS section
instead of just the install lines, dropping the from-source sign
snippet; it is back, with the current entitlements path and
libarchive in the brew line. Homebrew's tap-trust gate now leads the
macOS install: dependencies from third-party taps stay refused until
their tap is trusted once, and libkrun ships from its own tap.

README.md

@@ -16,9 +16,29 @@ sudo snap connect ecrou:kvm
 
 macOS (Apple Silicon, Homebrew):
 ```
+brew trust --tap libkrun/krun
 brew install vhaudiquet/ecrou/ecrou
 ```
 
+The `brew trust` step is Homebrew's tap-trust gate: dependencies from
+third-party taps stay refused until their tap is trusted once, and
+ecrou's engine, libkrun, ships from libkrun's own tap. The macOS
+build loads libkrun from that tap at runtime and boots through
+Hypervisor.framework; the formula signs the binary with the
+hypervisor entitlement macOS requires, so the install needs no extra
+steps. Building from source instead:
+
+```
+brew install libkrun/homebrew-krun/libkrun e2fsprogs libarchive
+cargo build --release -p ecrou-cli
+codesign --force --sign - --entitlements packaging/homebrew/ecrou.entitlements \
+  target/release/ecrou
+```
+
+Every local build needs that last line: cargo output is ad-hoc signed
+without the entitlement, and macOS refuses VM creation to it — `ecrou
+probe` says so and prints the command.
+
 ### Usage
 
 ```

SPEC.md

@@ -344,9 +344,13 @@ dependencies (`libkrun` from the krun tap, `e2fsprogs`, `libarchive`),
 builds from source with cargo, and re-signs the binary with the
 entitlements plist from `packaging/homebrew/` — brew bottles are
 ad-hoc signed, so the signature is part of the formula's install,
-not of the artifact. The formula is pinned by tag until the first
-release exists, then switches to the release tarball + sha256 the
-release workflow produces.
+not of the artifact. The in-repo formula's tag pin is a placeholder:
+the release workflow rewrites url and sha256 when it pushes the
+formula to the tap. Homebrew's tap-trust gate refuses dependencies
+from third-party taps until their tap is trusted, so the README
+leads with `brew trust --tap libkrun/krun` and CI trusts the tap
+before its install; removing that tax is another argument for
+libkrun landing in homebrew-core.
 
 ## Snap packaging