[Criseda]

Without a paid Apple developer account the app can't be notarized, so the official homebrew/cask tap won't take it. This adds the release side of a personal tap, Criseda/homebrew-tap, which serves the netscanner formula (the ns CLI) and the netscanner-app cask.

Changes

• Scripts/package-release.sh: builds the Release app (ad-hoc signed, as before), checks the signatures of the app and the embedded ns, and zips the app with ditto into build/release/NetScanner-<version>.zip. It prints the zip's SHA-256 for the cask.
• .github/workflows/release.yml: runs when a v* tag is pushed. It fails if the tag doesn't match MARKETING_VERSION or if CHANGELOG.md has no ## <version> section. Otherwise it runs the package tests, builds the zip and publishes a GitHub release. The notes are that CHANGELOG section plus the zip's SHA-256.
• README gets an Install section. AGENTS.md's Distribution section now describes this flow and the later Developer ID path. CHANGELOG has a new entry.

Testing

• Scripts/package-release.sh built a universal app (x86_64 + arm64). The app and Contents/Helpers/ns are ad-hoc signed with the hardened runtime and pass codesign --verify --strict. ns keeps the identifier io.github.criseda.netscanner.
• Installed that zip through the tap's cask, with its URL temporarily pointed at the local file. It installs to /Applications. The app has the quarantine attribute and Gatekeeper rejects it, as expected, so the cask's caveat explains Open Anyway and xattr -dr com.apple.quarantine. With the attribute cleared, the bundled ns runs.
• actionlint is clean, and the CHANGELOG section extraction was checked against a ## 0.1.0 heading.
• The workflow itself has not run yet. It runs on the first tag.

To release v0.1.0 after merging

1. Rename ## Unreleased to ## 0.1.0 in CHANGELOG.md.
2. Push the tag v0.1.0.
3. Copy the SHA-256 from the release notes into the tap's cask.