v2.4.1

ci: migrate goreleaser brews to homebrew_casks (#8)

## Summary
- `brews:` is being phased out by goreleaser ([deprecation
notice](https://goreleaser.com/deprecations/#brews)). The v2.4.0 release
log warned about this.
- Renames the section to `homebrew_casks:`, drops the formula-only
fields (`directory`, `license`, `install`, `test`), and adds a
post-install hook that strips `com.apple.quarantine` so unsigned darwin
binaries actually launch on modern macOS.

## Follow-up (in `abizer/homebrew-tap`)
- Add `tap_migrations.json` mapping `nssh` → cask, and delete the old
`Formula/nssh.rb` so existing `brew upgrade nssh` users land on the
cask.

## Test plan
- [ ] Cut a `patch` release via Actions → release → Run workflow;
confirm goreleaser publishes a cask to `abizer/homebrew-tap` under
`Casks/nssh.rb`
- [ ] `brew install --cask abizer/tap/nssh` on macOS, then `nssh` runs
without the "damaged / cannot be opened" Gatekeeper alert

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Low risk: release packaging config change only, but it can affect
macOS install/upgrade behavior if the tap expects a formula vs cask or
the post-install hook misbehaves.
> 
> **Overview**
> Updates GoReleaser Homebrew publishing from deprecated `brews` to
`homebrew_casks` for `nssh`, removing formula-specific fields
(`directory`, `license`, `install`, `test`).
> 
> Adds a macOS-only post-install hook to strip the
`com.apple.quarantine` xattr from the staged binary so the downloaded
(non-notarized) app can launch without Gatekeeper blocking.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
4c11a84028b2ffbac411bb03025e5bd7e4e9df80. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>