feat(release): ship shell completions in the cask

[ryanlewis]

PR 2 of #88 — the release plumbing. Builds on PR 1 (#94), which added the things completions <shell> command.

What

Wire generate_completions_from_executable into the homebrew_casks block so brew install runs things completions bash|zsh|fish at install time and drops the scripts into the Homebrew prefix. No custom executable: — it defaults to the first binary (things), which is correct for our root-level archive layout.

binary "things"
generate_completions_from_executable "things", "completions",
  base_name: "things",
  shell_parameter_format: :arg,
  shells: [:bash, :zsh, :fish]

The non-obvious part: quarantine ordering

Completion generation runs the binary during artifact install, which is before postflight. Our binary is unsigned, so it's Gatekeeper-quarantined on download — that's exactly why the cask already removed the quarantine xattr. But that removal lived in postflight, i.e. after the completion run. Left as-is, generate_completions_from_executable would invoke a still-quarantined binary, Gatekeeper would block it, and zero completion files would be written — silently.

Fix: move the xattr -dr com.apple.quarantine hook from postflight → preflight (hooks.post.install → hooks.pre.install). Homebrew runs preflight before artifact install, so the binary is de-quarantined in time. It's strictly safe for runtime too — same removal on the same staged binary, just earlier.

Docs

Flipped the README + internal/skill/SKILL.md wording from "doesn't generate completions yet" to "Homebrew generates these on install." (PR 1 had set the honest interim phrasing.)

Verification

• goreleaser check passes
• goreleaser release --snapshot --clean --skip=publish emits Casks/things.rb containing the generate_completions_from_executable block and the preflight de-quarantine
• go test ./internal/skill/ passes (SKILL.md is embedded)
• Post-tag (needs a real release): brew install ryanlewis/tap/things (or brew reinstall) writes bash/zsh/fish completion files into the prefix
• Post-tag: open a fresh shell, things <TAB> shows subcommands

The last two require a published tag, so they're for after merge + /release. The quarantine-ordering fix is the thing to watch in that test — if completions still don't appear, the next lever is no_quarantine or confirming the sandbox can exec the de-quarantined binary.