build(cli): homebrew tap for ferrvault CLI

[BryanFRD]

Goal

`brew install ferrlabs/tap/ferrvault` works for macOS users.

Why

On macOS, `brew` is the universal expectation. `curl | sh` works but feels off-pattern for Mac users.

What to do

1. Create a public repo `FerrLabs/homebrew-tap` (the `homebrew-` prefix is the Brew convention).
2. Add `Formula/ferrvault.rb` that downloads the right `ferrvault-darwin-{amd64,arm64}.tar.gz` and installs.
3. Automate the formula bump on every `cli-v*` release — either via a `brew bump-formula-pr` step in `cli-release.yml`, or via `mislav/bump-homebrew-formula-action`.

Sketch of the formula

class Ferrvault < Formula
  desc "Consumer CLI for FerrVault — fetch and inject secrets"
  homepage "https://ferrvault.com"
  version "0.1.1"

  on_macos do
    on_arm do
      url "https://github.com/FerrLabs/FerrVault/releases/download/cli-v#{version}/ferrvault-darwin-arm64.tar.gz"
      sha256 "<sha>"
    end
    on_intel do
      url "https://github.com/FerrLabs/FerrVault/releases/download/cli-v#{version}/ferrvault-darwin-amd64.tar.gz"
      sha256 "<sha>"
    end
  end

  def install
    bin.install "ferrvault"
  end

  test do
    assert_match version.to_s, shell_output("#{bin}/ferrvault --version")
  end
end

Linux Homebrew users also work with the same formula via the `on_linux do` block — bonus.

Out of scope

• Submitting to homebrew-core (`brew install ferrvault` without the tap). That requires our project to meet popularity thresholds; the tap pattern is the right starting point.