build: add the macOS gate, darwin artifacts, and a Homebrew formula

CI runs fmt/clippy/test plus a real alpine boot on a macos-26 runner
with libkrun from the krun tap; the release workflow ships a signed
darwin-arm64 tarball beside the snaps. The formula installs from the
tap, carries the runtime kegs (libkrun, e2fsprogs, libarchive), and
codesigns the binary with the hypervisor entitlement — Hypervisor
.framework grants VM creation only to entitled binaries on current
macOS, the same requirement krunkit's formula signs for.

packaging/homebrew/Formula/ecrou.rb

@@ -0,0 +1,46 @@
+# The formula lives in the repo and ships through the
+# vhaudiquet/homebrew-ecrou tap; it needs the same tap libkrun's
+# krunkit comes from, because the engine is dlopen'd from those kegs
+# at runtime.
+class Ecrou < Formula
+  desc "One-shot microVM environments"
+  homepage "https://github.com/vhaudiquet/ecrou"
+  # Pinned by tag until the first release exists; switch to the
+  # release tarball + sha256 then.
+  url "https://github.com/vhaudiquet/ecrou.git", tag: "v0.1.0"
+  license "MIT"
+
+  # libkrun's Hypervisor.framework backend is arm64-only upstream.
+  depends_on arch: :arm64
+  depends_on "rust" => :build
+  depends_on "libkrun/homebrew-krun/libkrun"
+  depends_on "e2fsprogs"
+  # A libarchive-capable mke2fs populates ext4 images from tarballs in
+  # one pass; without it the build falls back to a per-file tree walk.
+  depends_on "libarchive"
+
+  def install
+    system "cargo", "build", "--release"
+    bin.install "target/release/ecrou"
+    # Hypervisor.framework grants VM creation only to binaries signed
+    # with the hypervisor entitlement; on current macOS the signature
+    # is a hard requirement, the same one krunkit's formula carries.
+    system "codesign", "--force", "--sign", "-",
+      "--entitlements", "packaging/macos/ecrou.entitlements", bin/"ecrou"
+  end
+
+  def caveats
+    <<~EOS
+      The binary is ad-hoc signed with the com.apple.security.hypervisor
+      entitlement. Rebuilding from source (cargo) requires re-signing:
+        codesign --force --sign - --entitlements packaging/macos/ecrou.entitlements target/release/ecrou
+      `ecrou probe` reports this when the entitlement is missing.
+    EOS
+  end
+
+  test do
+    system bin/"ecrou", "probe"
+    output = shell_output("#{bin}/ecrou run --quiet alpine -- uname -r").strip
+    assert_match(/\d+\.\d+/, output)
+  end
+end

packaging/macos/ecrou.entitlements

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+<key>com.apple.security.hypervisor</key><true/>
+</dict></plist>