[Epic] Distribute Fallout via native package managers (winget, Homebrew, .deb)

## Epic

Distribute Fallout via the native package manager on each supported OS — both the **`fallout` CLI** (the .NET global tool, `Fallout.GlobalTools`, command `fallout`) and the **`fallout-agent`** deployment daemon (RFC #113) — so users and operators get a native, upgrade-managed install instead of a curl-piped tarball or manual `dotnet tool` steps.

## Why

The package manager is the install contract users care about: native install/upgrade/removal, and — for the agent daemon — signed provenance and service registration. Two artifacts with different shapes ride this:

- **`fallout` CLI** — framework-dependent global tool; brew/winget/apt install + `upgrade` without the manual `dotnet tool` dance.
- **`fallout-agent`** — signed, self-contained daemon; adds notarization/codesigning and native service (launchd/systemd/Windows service) registration.

Each artifact × platform is a separate parent story.

## Children

- #121 — Windows / winget (agent)
- #122 — macOS / Homebrew (agent)
- #123 — Linux / .deb (agent)
- #496 — macOS / Homebrew (the `fallout` CLI — sibling of #122)

## Cross-cutting concerns (deferred — track via comments here, not new stories yet)

- **Versioning policy.** Does the package-manager-published version always match Nerdbank.GitVersioning's `MajorMinorPatchVersion`, or do we strip prerelease tags for stable channels only?
- **Pre-release channels.** winget supports preview manifests, Homebrew taps can have `--HEAD`, `.deb` repos can have separate `unstable` suites. Out of scope until stable channels are shipping.
- **Cert / key custody.** Authenticode cert (#125), Apple Developer ID + notarytool credentials (#131), and project GPG key (#136) each need a documented rotation + custody plan. Likely one tracking issue once the rotation pattern is clear, not three. (Agent-only — the CLI ships unsigned via its runtime.)
- **Recurring cost.** Authenticode cert (~$200/yr+), Apple Developer Program ($99/yr), and any paid APT hosting (Cloudsmith etc.) add a non-trivial bill. Worth surfacing before sign-off.

## Related

- RFC #113 — CD deployment agent/runner
- RFC #106 — Continuous Delivery vision