chore(release): harden Homebrew tap publishing

[kdy1]

Summary

• switch nodeup Homebrew packaging to prebuilt release archives for macOS amd64/arm64 and Linux amd64
• replace the shared Homebrew PR flow with direct tap main pushes, including empty-tap bootstrap support
• document the new tap publishing and install contract across release docs and public nodeup docs

Testing

• bash -n scripts/release/update-homebrew.sh
• ./scripts/release/update-homebrew.sh --project nodeup --version 0.1.8 --darwin-amd64-url "https://github.com/delinoio/oss/releases/download/nodeup@v0.1.8/nodeup-darwin-amd64.tar.gz" --darwin-amd64-sha256 "b9d2c91b038f516d97cc41c031149288dbd174818f54753a1fec7988d8ce7221" --darwin-arm64-url "https://github.com/delinoio/oss/releases/download/nodeup@v0.1.8/nodeup-darwin-arm64.tar.gz" --darwin-arm64-sha256 "6dfc3643345388de8e1a9b8abd30e499f00d2c300fcaabe3e2bf11026de5f98b" --linux-amd64-url "https://github.com/delinoio/oss/releases/download/nodeup@v0.1.8/nodeup-linux-amd64.tar.gz" --linux-amd64-sha256 "4aefee934fd54de6faa37d0687bebb3aa9abac8f39ae8cc9126e311eca225f11" --dry-run
• dry-run renders for derun, dexdex-main-server, dexdex-worker-server, and dexdex
• mocked non-dry-run update-homebrew.sh rehearsal against an empty bare tap remote, including bootstrap and idempotent re-run
• cargo run -p nodeup -- --help
• pnpm --filter public-docs test

Notes

• live publication to the real delinoio/homebrew-tap still depends on the new HOMEBREW_TAP_GH_TOKEN secret being configured in GitHub Actions

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ce5ebdc9a0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve GH_TOKEN fallback in release workflows

This step overwrites GH_TOKEN with secrets.HOMEBREW_TAP_GH_TOKEN, so if the new secret is not present yet the value becomes empty and update-homebrew.sh aborts in non-dry-run mode (HOMEBREW_TAP_GH_TOKEN (or GH_TOKEN) is required). Because prior releases used secrets.GH_TOKEN and the script still supports that fallback, this change can block nodeup (and the same pattern in derun/dexdex) releases during secret migration. Use a workflow-level fallback so existing GH_TOKEN continues to work until all environments are updated.

Useful? React with 👍 / 👎.