fix(release): unblock homebrew Linux smoke test on untrusted-tap gate

[Matovidlo]

Summary

The test-install Homebrew (Linux) leg fails with:

Error: Refusing to load formula keboola/keboola-cli2/keboola-cli2 from untrusted tap keboola/keboola-cli2.

Some homebrew/brew image builds ship HOMEBREW_REQUIRE_TAP_TRUST set, which blocks loading formulae from a third-party tap. This unsets it in the smoke-test container.

Chosen over the brew trust command the error message suggests, because brew trust does not exist in current Homebrew (4.6.20) — verified directly in the image (Unknown command: brew trust). Unsetting the gating env var is version-independent and mirrors the default end-user environment, where the var is unset (so real brew install users are unaffected either way).

Scope

• .github/workflows/release-kbagent.yml, the Homebrew (Linux) smoke-test step only. One line + comment.
• The other release-workflow failures are handled elsewhere and are not in this PR:
  • Homebrew tap push (target-directory . → Formula/) + chocolatey checksum byte[] — fix(release): unbreak homebrew + chocolatey publish jobs #476 (merged).
  • WinGet bootstrap-aware skip — ci(release): make winget job bootstrap-aware for un-submitted manifest (#484) #485 (open, @padak). That PR supersedes the winget fix this branch originally carried.
• Rebased onto current main; the redundant homebrew/chocolatey/winget changes this branch previously had were dropped.

Impact analysis

• No product/SDK/runtime code touched.
• Runs on non-prerelease tags (IS_PRERELEASE == 'false'); takes effect on the next stable tag.
• No breaking changes.

Test plan / verification notes

• Next stable tag: test-install Homebrew (Linux) leg taps + installs keboola-cli2 and greps the version.
• Local verification caveat: the brew install path could not be run locally — the sandbox Docker has no outbound network (Could not resolve host: formulae.brew.sh). The fix rests on two network-independent facts confirmed in the image: brew trust is not a command in 4.6.20, and the untrusted-tap refusal is gated by HOMEBREW_REQUIRE_TAP_TRUST (per man brew / brew trust help text).

[Matovidlo]

@claude review

[Copilot]

Pull request overview

Updates the release/tagging GitHub Actions workflow to unblock two failing release legs: pushing the rendered Homebrew formula to a (previously empty) tap repository, and correctly parsing the Chocolatey checksum fetched from a .sha256 sidecar served as octet-stream.

Changes:

• Enable automatic creation of the Homebrew tap target branch on first push (create-target-branch-if-needed).
• Decode Chocolatey .sha256 content when returned as bytes before extracting the checksum field.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[padak]

Closing in favor of #483 (merged) -- the two PRs fixed the same untrusted-tap failure with contradictory approaches, and the contradiction turned out to have a simple explanation:

Homebrew 6.0.0 (released 2026-06-11) introduced tap trust as a default-on security mechanism, together with the new brew trust command: https://brew.sh/2026/06/11/homebrew-6.0.0/

• Your verification ("brew trust does not exist, Unknown command in 4.6.20") was correct for the image you had -- a pre-6.0 homebrew/brew cache. Current image pulls (and the CI runner, whose error message itself suggests Run 'brew trust ...' -- that remedy text ships with 6.0) run Homebrew 6.x where the command exists.
• unset HOMEBREW_REQUIRE_TAP_TRUST would also unblock the smoke test, but on Homebrew 6 the enforcement is default-on for third-party taps regardless of the pre-6.0 env var, and real end users now have to run brew trust keboola/keboola-cli2 before brew install. Keeping the trust step in the smoke test exercises the genuine install path instead of bypassing the gate.

Thanks for the rebase and the careful scoping of this PR -- the winget and homebrew-tap-push pieces you split out earlier (#476, #485) were the right call. Follow-up noted separately: the install docs should mention the brew trust step for Homebrew 6 users.