Notify the Homebrew tap on release, and drop the retired macos-13 runner

[MihaiBojin]

Two release-path fixes, plus the actionlint findings in the file they touch.

Notify the tap on release

releasetools/homebrew-tap#16 bumps the formula from the published release. It already polls daily, so this only shortens the delay — which is why a missing token is a ::notice:: rather than a failure:

- name: Notify the Homebrew tap
  if: startsWith(github.ref, 'refs/tags/')
  env:
    GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
    VERSION: ${{ github.ref_name }}
  run: |
    if [ -z "${GH_TOKEN:-}" ]; then
      echo "::notice::HOMEBREW_TAP_TOKEN is not set; the tap will pick up $VERSION on its next scheduled run."
      exit 0
    fi
    gh api --method POST repos/releasetools/homebrew-tap/dispatches \
      -f event_type=upstream-released \
      -f "client_payload[version]=$VERSION"

GITHUB_TOKEN cannot dispatch to another repository, so this needs a HOMEBREW_TAP_TOKEN secret with contents: write on releasetools/homebrew-tap. Until one exists the step is a no-op — nothing here can break a release.

The tag goes over as client_payload.version, so the tap bumps to the release that just shipped rather than whatever is newest when it wakes up.

Manual bumping is handled on the tap side by the workflow_dispatch input in releasetools/homebrew-tap#16 — optional vX.Y.Z, defaulting to the newest release.

Drop the retired macos-13 runner

test-platforms still listed macos-13. GitHub has retired that image, so the label no longer resolves to a runner and the leg would fail to schedule. actionlint rejects it against its current label list:

label "macos-13" is unknown. available labels are ... "macos-26", "macos-15", "macos-14" ...

The last test-release run (v0.0.12, 2025-09-06) predates the retirement and passed, which is why this hasn't bitten yet — it would bite on the next release.

Replaced with macos-26, which also matches the images the homebrew tap tests against, so the two repos now cover the same macOS set.

Also

Quoted the three >> $GITHUB_ENV redirections in the same file — actionlint's only other findings there. Both workflows are now clean:

$ actionlint .github/workflows/release.yaml .github/workflows/test-release.yaml
$

make test passes; shellcheck clean.

🤖 Generated with Claude Code

[MihaiBojin]

The HOMEBREW_TAP_TOKEN placeholder in this PR should become a GitHub App token rather than a PAT — tracked in #30.

Two reasons beyond the usual PAT objections:

1. The org already provisions an automation App (releasetools/terraform-github-app), with GH_APP_CLIENT_ID / GH_APP_PRIVATE_KEY in place and a pinned create-github-app-token usage in multirepo. This is wiring, not new infrastructure.
2. More importantly, a PR opened with GITHUB_TOKEN has its CI gated pending approval — and on the tap side that CI is brew test-bot --only-formulae, the only check protecting against a bad formula. An App token isn't subject to that.

This PR is still safe to merge as-is: with no secret set, the notify step logs a ::notice:: and the tap falls back to its daily poll.