docs: describe how the Homebrew tap is actually updated

[ethanzhoucool]

RELEASING.md documented a HOMEBREW_TAP_TOKEN setup step that was never completed and cannot be completed without admin on this repo. The v0.2.0 release published its binaries fine and then failed on the cask step with 401 Bad credentials.

The tap now updates itself instead: a workflow there polls this repo's public releases hourly, regenerates Casks/greenlight.rb from the published checksums.txt, and commits with its own GITHUB_TOKEN. Reading a public repo's releases needs no credentials and a workflow can always write to its own repo, so that path needs no secret and no admin. Verified end to end: the commit step ran, the bot pushed, and brew install revylai/tap/greenlight now yields 0.2.0 with playscan.

Also records the three things that cost time working this out:

• The tap serves a cask, and a leftover Formula/greenlight.rb silently outranks it (that is why the tap kept serving v0.1.0). GoReleaser's brews output is deprecated and now fails goreleaser check.
• Locally built archives are not byte-reproducible, so a cask generated from --snapshot carries hashes that fail verification on every install. Hashes must come from the release's checksums.txt.
• GoReleaser infers the repo from the git remote, so a dry-run on a fork bakes the fork's URLs into the cask. Now pinned.

If HOMEBREW_TAP_TOKEN is ever configured, both paths coexist: the tap workflow emits output byte-identical to GoReleaser's template, so whichever runs second is a no-op rather than a revert.

---

Note

Low Risk
Documentation-only change with no runtime, auth, or release workflow code modifications in this diff.

Overview
Rewrites RELEASING.md so release docs match how installs actually work today, instead of assuming GoReleaser pushes the tap with HOMEBREW_TAP_TOKEN.

The one-time HOMEBREW_TAP_TOKEN setup is removed as a required step. Releases are described as tag-driven GoReleaser builds that publish GitHub binaries and checksums only. Cutting a release now tells you to bump version in metadata.json and .claude-plugin/plugin.json in a normal PR before tagging, uses an annotated tag example (v0.2.0), and puts goreleaser check before the snapshot dry-run.

A new “How the Homebrew tap is updated” section explains why the in-repo homebrew_casks push failed (401 without admin-configured HOMEBREW_TAP_TOKEN), that RevylAI/homebrew-tap updates itself via an hourly workflow that regenerates Casks/greenlight.rb from public releases, and how to verify with brew update / brew info --cask. It notes optional coexistence if the token is ever added.

“Gotchas worth knowing” adds operational pitfalls: cask vs formula (leftover Formula/greenlight.rb wins), checksums must come from release checksums.txt (not local --snapshot builds), and GoReleaser repo inference on forks (doc references pinning release.github in .goreleaser.yml).

^{Reviewed by Cursor Bugbot for commit 372a9ec. Bugbot is set up for automated code reviews on this repo. Configure here.}