chore(release): migrate off deprecated goreleaser 'brews' config

[asheshgoplani]

goreleaser warns: 'DEPRECATED: brews should not be used anymore' — migrate to the replacement (homebrew_casks/repository config per goreleaser docs) before it becomes a hard error. Combine with the attestation fix so the release job can go fully green again.

[asheshgoplani]

Looked at this as part of #1767 (the #1763 / #1760 fix). Short version: that PR makes the deprecation harmless, but deliberately does not migrate to homebrew_casks, and I think that call needs your sign-off before this issue is closed.

The urgency is lower than the deprecation warning suggests. The GoReleaser docs state: "Deprecated options are only removed on major versions of GoReleaser", and release.yml pins the action to ~> v2, so brews cannot become a hard error without an explicit major bump in this repo. Confirmed empirically: the v1.10.11 run used goreleaser 2.17.1 — past the v2.16 hard-deprecation — and brews still only printed the warning and generated the formula normally.

The migration cost is higher than "rename one key", though.

1. Casks are macOS-only. We ship linux/amd64 + linux/arm64, and README.md, install.sh and this repo's own homebrew-verify.yml header all advertise brew install asheshgoplani/tap/agent-deck to Mac and Linux/WSL users (Missing homebrew formula #873). A cask silently drops every Linuxbrew user.
2. It is a cross-repository, user-visible migration. The docs' recommended path needs a tap_migrations.json plus deleting Formula/agent-deck.rb in asheshgoplani/homebrew-tap, so existing installs transition instead of breaking. And scripts/verify-homebrew-install.sh is hard-wired to Formula/agent-deck.rb, so the regression gate has to move in the same change.
3. It cannot be validated right now. HOMEBREW_TAP_GITHUB_TOKEN returns 401 Bad credentials, so no tap write of any shape can be exercised until it is rotated.
4. Sequencing. Bundling it into fix(release): brew tap out of the release critical path so SLSA provenance ships (closes #1763, #1760) #1767 would make the next release exercise a new push path and a new tap layout at once. release: brews skip_upload + post-publish tap push (completes #1762, fixes #1760 attestation gate) #1763's whole point is to get the tap out of the release critical path — better to prove that over one real release first.

What #1767 does instead: brews.skip_upload: true, so the deprecated block does nothing but render a file locally and never touches the network, and the push moves to a post-publish step that cannot fail the release. The rationale plus a migration checklist is recorded as a comment above the brews block so nobody has to rediscover it.

So: if you agree, this can be closed as decided (the risk it was filed about is gone). If you'd rather do the cask migration, it deserves its own PR, after the tap token is rotated and #1767 has survived one real release — happy to do it then, including the tap_migrations.json and the verify-homebrew-install.sh rewrite.