docs: correct install — Homebrew 6 can't skip quarantine, use xattr/Open Anyway

Author: kvnwolf

.claude/skills/release/SKILL.md

@@ -7,7 +7,7 @@ argument-hint: "[patch|minor|major]"
 
 Cut ONE release of **mad-eye** (the macOS menubar app) to **GitHub Releases + a Homebrew cask**. Every step ends on a gate — a checkable condition; stop and report at the first gate that fails.
 
-Distribution is **unsigned/ad-hoc on purpose**: mad-eye uses `macOSPrivateApi` (the transparent + vibrancy Popover), which bars the Mac App Store, and its audience is Claude Code users (small, technical). So we ship an unsigned **Homebrew cask**: users install with `--no-quarantine` (or approve once via System Settings → Privacy & Security) because macOS Gatekeeper flags unsigned apps — cheaper than an Apple Developer ID + notarization, at the cost of that one-time friction. Graduate to signing only if it gets real traction. The app version lives in `src-tauri/tauri.conf.json` (`CFBundleVersion` derives from it); `package.json` + `src-tauri/Cargo.toml` mirror it in lockstep.
+Distribution is **unsigned/ad-hoc on purpose**: mad-eye uses `macOSPrivateApi` (the transparent + vibrancy Popover), which bars the Mac App Store, and its audience is Claude Code users (small, technical). So we ship an unsigned **Homebrew cask**: users clear the Gatekeeper quarantine themselves (`xattr -dr com.apple.quarantine`, or System Settings → Privacy & Security → Open Anyway) since Homebrew 6 quarantines casks with no opt-out — cheaper than an Apple Developer ID + notarization, at the cost of that one-time friction. Graduate to signing only if it gets real traction. The app version lives in `src-tauri/tauri.conf.json` (`CFBundleVersion` derives from it); `package.json` + `src-tauri/Cargo.toml` mirror it in lockstep.
 
 **One-time setup** (before the FIRST release, else Step 1/3/5 gates fail): a GitHub remote exists (`git remote add origin …` + an initial push); both universal Rust targets installed (`rustup target add aarch64-apple-darwin x86_64-apple-darwin`); `gh` authenticated. The Homebrew tap (`kvnwolf/homebrew-tap`) and its cask are scaffolded by Step 5 on the first release if missing.
 
@@ -110,7 +110,7 @@ end
 
 ## Step 6: Smoke + report
 
-- Optional local smoke (skip if the user doesn't want it live-installed on this machine): `brew install --cask --no-quarantine kvnwolf/tap/mad-eye` (add `--force` to reinstall over an existing copy) — `--no-quarantine` skips Gatekeeper so the unsigned app opens directly; without it macOS blocks the first launch.
+- Optional local smoke (skip if the user doesn't want it live-installed on this machine): `brew install --cask --force kvnwolf/tap/mad-eye`, then `xattr -dr com.apple.quarantine /Applications/mad-eye.app` (Homebrew 6 quarantines casks with no opt-out — `--no-quarantine` is gone; the `xattr` clears it so the unsigned app opens). Launch and confirm the Eye appears in the menubar.
 - Report to the user: version published, inferred bump + reasoning, DMG path + `sha256`, tag + GitHub release URL, cask commit URL, and the `brew install --cask kvnwolf/tap/mad-eye` command.
 
 ## Acceptance checklist

README.md

@@ -62,12 +62,12 @@ popover to make it the one that drives the Eye (it remembers your choice).
 ### Homebrew (recommended)
 
 ```sh
-brew install --cask --no-quarantine kvnwolf/tap/mad-eye
+brew install --cask kvnwolf/tap/mad-eye && xattr -dr com.apple.quarantine /Applications/mad-eye.app
 ```
 
-`--no-quarantine` skips Gatekeeper's quarantine so the app opens straight away — reasonable for an
-open-source tool whose [source you can read](src-tauri/src). Prefer to keep the check? Install
-without the flag, then approve it once under **System Settings → Privacy & Security → Open Anyway**.
+The `xattr` half clears the Gatekeeper quarantine so the unsigned app opens — Homebrew can't skip it,
+and the [source is right here to audit](src-tauri/src). Prefer clicking? Install with just the `brew`
+half, then approve mad-eye under **System Settings → Privacy & Security → Open Anyway**.
 
 ### Manual