Bump tap formula on stable tag + add macOS smoke test

Parent: #122

Release workflow bumps the formula in `ChrisonSimtian/homebrew-fallout` on every stable tag, and a macOS CI job runs the full smoke install path.

## Definition of done

Formula update:
- Workflow opens a PR (or auto-merges) to `homebrew-fallout` with the new version, URL, and per-bottle SHA256s drawn from __M2__'s release artifacts.
- `brew audit --strict --online fallout-agent` passes after the update.

Smoke test (`macos-latest` job, run on release-candidate tags + manual dispatch):
1. `brew tap ChrisonSimtian/fallout && brew install fallout-agent`.
2. Assert binary is signed + notarized (`spctl --assess`).
3. `brew services start fallout-agent`; assert launchd shows the daemon running.
4. Mocked coordinator handshake — agent reaches a local stub, returns "enrolled".
5. `brew services stop && brew uninstall fallout-agent`; assert plist is removed.
6. Job exits 0 only if all five assertions succeed.