fix(ci): migrate homebrew-release.yml from PAT to GitHub App auth

[Data-Wise]

Summary

Replaces the workflow_call to Data-Wise/homebrew-tap/.github/workflows/update-formula.yml@main (which depended on the expiring HOMEBREW_TAP_GITHUB_TOKEN PAT) with an inline job that uses GitHub App auth.

The App credentials (APP_ID + APP_PRIVATE_KEY) are already configured on this repo and mint a short-lived, repo-scoped token per run via actions/create-github-app-token@v1.

What changed

• prepare job: unchanged (computes version + tarball SHA256).
• update-homebrew job: no longer a workflow_call. Now inlines:
  1. Mint a GitHub App token scoped to Data-Wise/homebrew-tap.
  2. Checkout homebrew-tap with that token (persist-credentials: false).
  3. Patch Formula/flow-cli.rb in place with sed (URL version + first sha256).
  4. Commit and push directly to homebrew-tap's main with retry-on-rebase.

flow-cli specifics (deviations from craft pattern)

• flow-cli is a hand-crafted formula in the manifest (generated: false), so the workflow does not call generator/generate.py — that would overwrite the carefully maintained def install/def caveats blocks. We patch Formula/flow-cli.rb directly via sed instead.
• For the same reason, generator/manifest.json is not updated by this workflow (mirroring the existing reusable workflow's behavior, which skips manifest updates when generated: false).
• source_type: github only, so the URL pattern is the simple GitHub tarball form.

Test plan

• YAML is valid (python3 -c "import yaml; yaml.safe_load(...)")
• CI on this PR passes (no release triggered — workflow only runs on release: published or workflow_dispatch)
• Next v* release tag triggers the workflow successfully against homebrew-tap

References

• Reference implementation: Data-Wise/craft@c99e04de and @6d6642a2
• Tracking issue: homebrew-release.yml: HOMEBREW_TAP_GITHUB_TOKEN expired — auth failure on cross-repo push craft#129
• The PAT (HOMEBREW_TAP_GITHUB_TOKEN) is left in place for now and can be removed in a follow-up once a release verifies the new auth path.