cask: avoid repeat upgrade alerts

[MikeMcQuaid]

• avoid showing repeated quarantine alerts on brew upgrade when the app's own updater would usually not prompt again
• keep quarantine in place through download and install so Gatekeeper still checks upgraded apps before first launch
• only clear quarantine after install when the previous app was already accepted and signed Identifier or TeamIdentifier values do not change
• keep quarantine when approval is missing or signing changes, so upgrades do not silently trust different code or malware
• add upgrade and quarantine specs covering approval, signing changes, and partially unset signing metadata

---

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same change?
• Have you added an explanation of what your changes do and why you'd like us to include them? Performance claims (e.g. "this is faster") must include Hyperfine benchmarks.
• Have you written new tests (excluding integration tests) for your changes? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) with your changes locally?

---

• AI was used to generate or assist with generating this PR. Please specify below how you used AI to help you, and what steps you have taken to manually verify the changes. Non-maintainers may only have one AI-assisted/generated PR open at a time.

Used OpenAI Codex with manual review, editing and testing.

---

[Copilot]

Pull request overview

This PR aims to reduce repeated Gatekeeper/quarantine prompts during brew upgrade --cask by keeping quarantine enabled through download/install, then conditionally removing quarantine post-install only when prior user approval exists and the app’s signing identity hasn’t changed.

Changes:

• Add Cask::Quarantine.user_approved? and Cask::Quarantine.signing_identity helpers (with specs).
• Extend Cask::Upgrade with logic intended to conditionally release quarantine after upgrade based on prior approval + signing identity match.
• Add upgrade specs covering approval/signing scenarios.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
Library/Homebrew/cask/upgrade.rb	Adds upgrade-time logic to cache old approval/signing identity and (intended) conditional post-install quarantine release.
Library/Homebrew/cask/quarantine.rb	Adds helpers to detect user approval from quarantine xattr and to parse signing identity from codesign.
Library/Homebrew/test/cask/upgrade_spec.rb	Adds unit specs for the quarantine-release decision logic and prefetch quarantine behavior.
Library/Homebrew/test/cask/quarantine_spec.rb	Adds specs for user_approved? parsing and signing_identity parsing behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[bevanjkay]

Seems to work as intended in my local testing. Thanks!