ci: add Homebrew formula install/test/audit job (#442)

[aviadshiber]

Summary

• packaging/homebrew/kapsis.rb was only validated via static grep in tests/test-ctl-packaging.sh — the formula itself never ran through brew, so a Ruby syntax error or a broken install/test do block would ship silently.
• Adds .github/workflows/homebrew-formula-test.yml (macos-latest), triggered on changes to packaging/homebrew/**, that runs:
  • brew install --formula --build-from-source ./packaging/homebrew/kapsis.rb
  • brew test kapsis
  • brew audit --strict --formula ./packaging/homebrew/kapsis.rb
• Wires it into release.yml as a post-release sanity job (formula-test, needs update-packages), so once the version-bumped formula and its release assets are live, the real installability is checked automatically. Since update-packages pushes the bump as a new commit to main and the caller's own triggering ref is the pre-bump commit, the reusable workflow accepts a ref input and release.yml passes ref: main so it validates the commit that was actually just pushed.
• Scope/limitation (documented as a comment in the new workflow): per-platform binary resource blocks in the formula point at GitHub Release assets for the version already committed (matching sha256s). Those assets don't exist yet for an unreleased version being developed in a PR, so this job validates the currently committed (i.e. latest already-released) formula as-is — it does not attempt to simulate installing an unreleased version. It still catches the real failure mode from Homebrew formula is never executed in CI — kapsis.rb install/test blocks validated only by static grep #442: a syntax error or broken block in the Ruby formula.

Fixes #442

Test plan

• python3 -c "import yaml; yaml.safe_load(...)" on both changed workflow YAML files — parses cleanly
• ./tests/run-all-tests.sh --quick — all passing (pre-existing suite, unaffected by this CI-only change)
• No shell scripts changed — shellcheck not applicable
• New job's first live run on GitHub Actions (macOS runner + real brew) will be observed once this PR is open, since paths: packaging/homebrew/kapsis.rb won't fire for this PR (it only touches workflow files) — confirm the workflow itself is at least syntactically valid to GitHub via workflow_dispatch or a follow-up formula touch if needed

🤖 Generated with Claude Code