Homebrew formula updates should verify checksums without trusting public release re-downloads

[Widthdom]

Problem

The Homebrew publish job downloads sha256sums.txt from the just-created public release and uses it to populate formula checksums.

Evidence

.github/workflows/release.yml builds:

CHECKSUMS_URL="${RELEASE_URL}/sha256sums.txt"
checksums="$(mktemp)"
curl -fsSL "$CHECKSUMS_URL" -o "$checksums"

This re-enters the public release/CDN path after artifacts were already produced in the workflow.

Expected behavior

Derive formula checksums from workflow-owned release files/artifacts or verify the downloaded checksum manifest against the signed/attested artifact set before using it for tap updates.

Labels

security, github_actions

[Widthdom]

Work started on branch fix-issue3485-3486-3487-3489-3490-3491-3508.