ci: bump homebrew-tap formula on agent release

[rado0x54]

Summary

• Adds a step to agent-release.yml that rewrites Formula/shellwatch-agent.rb in rado0x54/homebrew-tap after a successful release: bumps version and the four per-arch sha256 hashes (read from the .sha256 files already in artifacts/), then commits + pushes to the tap's main.
• Uses a python3 rewrite that fails the job if any pattern doesn't match exactly once — a malformed/stale tap formula can't ship silently.
• Skips with a ::notice:: if HOMEBREW_TAP_TOKEN is unset, so a forked/detached clone of this repo can still cut releases.
• Pushes directly to the tap's main (no protection ruleset on the personal tap; PR ceremony adds nothing).

Why

The tap's README claimed "auto-bumps via a workflow in the upstream repo" but no such step existed — every release would have required a manual formula edit. This makes that claim true.

Required setup (already done)

• HOMEBREW_TAP_TOKEN repo secret — fine-grained PAT with Contents: write scoped to rado0x54/homebrew-tap only.

Test plan

• Local simulation: extracted the dedented run: block, fed it fake version + sha256s against a fixture formula — version + all 4 hashes rewritten, commit created, push would fire.
• Local simulation of the unset-secret path — clean exit 0 with the notice.
• YAML parses (Ruby YAML.load_file); step ordering is Create GitHub Release → Bump homebrew-tap formula → Open CHANGELOG PR to develop.
• End-to-end verification on the next real agent release.