Distribution channels: Homebrew cask and Snap

## Why

Capsem is installed today by `curl | sh`, a `.deb`, or a macOS `.pkg`. Users expect their platform's package manager.

## Homebrew (macOS) — smallest, do first

A cask pointing at the signed, notarized `.pkg` we already publish. The release lane already produces and notarizes that artifact, so this is a tap plus a version-bump step. No new build.

- Cask in a `google/capsem` tap, or submit to homebrew-cask once the project is public.
- The release lane bumps the cask version and sha256 after publication.
- `brew install --cask capsem` / `brew upgrade` must not fight the built-in self-update. Decide which owns updates and make the other defer — two updaters racing on the same install is worse than either alone.

## Snap (Linux) — medium

Confinement is the interesting part. Capsem needs `/dev/kvm`, `/dev/vhost-vsock`, a background service, and a UDS at `~/.capsem/run/`.

- Verify vhost-vsock is reachable under confinement at all. If it is not, snap is classic-only, which changes the review path.
- Service registration differs under snapd.
- Snap autoupdates on its own schedule, which collides with the channel model in `tmp/release-spec.md`. Decide whether snap channels map onto Capsem channels or replace them.

## Order

Homebrew, then Snap. Alpine/musl (#182) is independent of both and is what unblocks a Linux story beyond Debian/Ubuntu.

## Explicitly out of scope

Windows package managers (Chocolatey, winget). There is no Windows support to package: Capsem boots real VMs through Apple Virtualization.framework or KVM, so Windows needs a third hypervisor backend, a service model, an installer, and a vsock equivalent first. Packaging is the last five percent of that port, not a sibling of the two channels above. Not being pursued now.

## Related

- #174 — the deb declared no libc floor (fixed)
- #181 — lower the glibc floor to cover Ubuntu 22.04 / Debian 12
- #182 — musl/Alpine package

Start by inspecting the existing release lane and the channel model in tmp/release-spec.md, then trace how the signed, notarized .pkg and Linux artifacts are published. Define the Homebrew cask flow first, including update ownership, before investigating Snap confinement, service registration, UDS access, and channel mapping. Done means both distribution paths have agreed release and update behavior.

Written by the indexing model from the issue text.