As a macOS operator I can install fallout-agent via Homebrew

## Story

As a macOS operator managing a CD target host, I want to install the Fallout deployment agent with a single `brew install fallout-agent` (from the project's tap) so I get a notarized binary and a launchd daemon managed by `brew services`, with no manual codesigning rituals or LaunchAgent XML editing.

## Why

RFC #113 defines `fallout-agent` as a self-contained executable that operators run on hosts the forge runner can't reach. For macOS hosts, "self-contained executable" trips over Gatekeeper, notarization, and launchd registration. Homebrew is the de facto package manager for macOS developers and ops — shipping a tap gives operators a one-line install that handles signing, runtime registration, and upgrades.

## Acceptance criteria

Sub-tasks (filled in after creation):

- [ ] #129 — Stand up `homebrew-fallout` tap with initial formula
- [ ] #130 — Build and upload Homebrew bottles to GitHub Releases
- [ ] #131 — Codesign and notarize the macOS binary
- [ ] #132 — Formula installs launchd plist via `brew services`
- [ ] #133 — Bump tap formula on stable tag + add macOS smoke test

## Out of scope

- Submission to `homebrew-core` — start with the project tap; revisit promotion to core when install base justifies it.
- Apple silicon vs Intel matrix beyond the agreed baseline. Baseline tracks currently-supported (non-EOL) macOS — as of 2026-07: `arm64_tahoe`, `arm64_sequoia`, `arm64_sonoma`, plus `x86_64_sequoia`, `x86_64_sonoma` (Intel best-effort, tracking Homebrew's own x86_64 wind-down). Ventura (macOS 13) dropped as EOL.
- App Store distribution (out of scope; agent is a daemon, not a UI app).

## Related

- RFC #113 — CD deployment agent/runner
- RFC #106 — Continuous Delivery vision