Publish ksail & ksail-desktop casks to official homebrew/cask tap (blocked on notability)

## Goal

Publish **both** Homebrew **casks** — `ksail` (CLI) and `ksail-desktop` (GUI) — to Homebrew's **official `homebrew/cask` tap**, so users can `brew install --cask ksail` / `ksail-desktop` without tapping the third-party `devantler-tech/homebrew-tap` first.

**Scope decision:** everything ships as a **cask** to `homebrew/cask`. We will **not** publish anything to `homebrew/core` (no formula). `homebrew/core` requires building from source under a DFSG/OSI **open-source** license, which KSail's **PolyForm Shield 1.0.0** (source-available, non-compete) does not satisfy — and we are **not** relicensing to pursue it. `homebrew/cask` imposes no license restriction, so it is our only official target, for both artifacts.

This is a tracking issue. We **cannot submit yet** — see blockers below. Revisit when the criteria are met.

## Current state

Both ship as casks to `devantler-tech/homebrew-tap` and the release pipeline drives them to merge automatically:

- `ksail` cask — `.goreleaser.yaml` (`homebrew_casks:`), a **binary-only** cask (`binary "ksail"`, macOS + Linux tarballs)
- `ksail-desktop` cask — `.goreleaser.desktop.yaml`, a **GUI** cask (`app "KSail.app"`, macOS arm64)
- `.github/workflows/cd.yaml` `homebrew` job — promotes both draft cask PRs and merges them post-publish

The destination changes (third-party tap → `homebrew/cask`); the **artifact shape does not** — both stay casks. Nothing becomes a `homebrew/core` formula.

## Blockers

### 1. Notability — blocks BOTH (the gating blocker)

Homebrew rejects "obscure" submissions. Because we are the project maintainers, the **self-submission** (3×) thresholds apply — meeting **any one** clears it:

| Metric | Self-submit threshold | Current |
|---|---|---|
| Stars | ≥ 225 | **147** |
| Forks | ≥ 90 | **10** |
| Watchers | ≥ 90 | **2** |

We currently meet none. (A *non-affiliated* community member could submit at the lower 75★ / 30-fork / 30-watcher bar — 147★ would pass — but that cannot be self-driven.)

### 2. `ksail` CLI cask — binary-only-cask policy risk

`homebrew/cask` policy says an open-source, CLI-only cask (uses only the `binary` artifact) "should be a `homebrew/core` formula instead." Our `ksail` cask is exactly that shape (`binary "ksail"`), so reviewers may push back and try to redirect it to core.

**Our position:** core is **off the table** — PolyForm Shield is not a DFSG/OSI license and we are not relicensing — so the CLI cannot become a core formula. We will therefore pursue the `ksail` CLI as a **cask** on `homebrew/cask`, making the case that, since a core formula is impossible under our license, the binary cask is the only viable official-tap form for it. If reviewers ultimately reject the CLI cask, the fallback is to keep it on the third-party tap (we do **not** relicense as a workaround). `ksail-desktop` (a real GUI `app` cask) is unaffected by this policy point.

### 3. `ksail-desktop` — code-signing / notarization

The desktop cask strips quarantine on install (`xattr -dr com.apple.quarantine`, `.goreleaser.desktop.yaml`) because `KSail.app` is **unsigned and un-notarized**. Cask reviewers flag apps that don't pass Gatekeeper. Before submitting, sign + notarize the `.app` (Apple Developer ID) so the quarantine hack is unnecessary.

## Acceptance criteria (revisit when all true)

- [ ] Repo notability clears the self-submission bar (≥ 225★ **or** ≥ 90 forks **or** ≥ 90 watchers) — or a non-affiliated contributor volunteers to submit at the 75★ bar
- [ ] `ksail-desktop` `.app` is code-signed + notarized (Developer ID), quarantine-strip hook removed
- [ ] Submit **`ksail` CLI cask** to `Homebrew/homebrew-cask` (argue the binary-cask case; fall back to the third-party tap if rejected — no relicensing)
- [ ] Submit **`ksail-desktop` cask** to `Homebrew/homebrew-cask`
- [ ] **Nothing submitted to `homebrew/core`** — no formula, no relicensing of the CLI
- [ ] Keep the third-party `devantler-tech/homebrew-tap` as a fallback/mirror

## References

- Homebrew — Acceptable Casks: https://docs.brew.sh/Acceptable-Casks
- Homebrew — Acceptable Formulae (license + notability): https://docs.brew.sh/Acceptable-Formulae
- License: `LICENSE` (PolyForm Shield 1.0.0)

**Blocker:** homebrew/cask notability policy | last-verified 2026-08-17: premise needs re-framing, not a wait — docs.brew.sh *Acceptable Casks* defines **no numeric notability thresholds** (no stars/forks/watchers numbers); it states only that established apps and recently-released apps with "substantial, independently verifiable public interest" may be considered, and that these "permit further review but do not guarantee inclusion". It also routes open-source **command-line** software to `homebrew/core` rather than cask, and notes a `homebrew/core` rejection does not by itself make software cask-eligible. *Acceptable Formulae* likewise publishes no numeric thresholds. ksail is at 165 stars / 11 forks / 3 watchers. So the "blocked on notability" framing rests on thresholds Homebrew does not currently publish, and the CLI/desktop split matters: the CLI would be a `homebrew/core` formula question, only ksail-desktop is a cask question. Re-scope this issue against the two current policy pages before treating it as externally blocked.