08 — Packaging & release: cross-compiled binaries, the wheel, and brew

[rahlk]

Part of #9. Phase 1 — level 1. Related: #1 (macOS binary signing — resolve it here).

Learning goals

Cargo release engineering (TRPL More About Cargo and Crates.io): profiles (lto, strip),
cross-compilation targets, and the CLDK distribution pattern — a compiled analyzer ships as a
self-contained binary wrapped in a thin platform-tagged PyPI wheel.

Task

Upgrade the existing single-target release.yml to the full distribution spec
(references/packaging-and-release.md; codeanalyzer-typescript's release is the compiled-case
model):

• Cross-compile matrix: aarch64/x86_64-apple-darwin, x86_64/aarch64-unknown-linux-musl
  (static!), optionally windows-msvc. Binaries as GitHub Release assets.
• Thin PyPI wheel: packaging/python/ — one platform-tagged wheel per target carrying the
  binary + bin_path(); publish as codeanalyzer-rust via OIDC Trusted Publishing.
• Brew: packaging/homebrew/generate_formula.sh emitting a binary-asset formula (like
  cants', with per-OS/arch url+sha256 blocks) pushed to codellm-devkit/homebrew-tap.
• macOS signing/notarization for the darwin assets — closes Sign generated binaries so it may be called from mac os natively #1.
• Keep the existing tag-triggered flow: tests gate the tag; changelog + Announcements discussion.

Gate

• A dry-run tag on a fork/branch produces: all target binaries, installable wheels
  (pip install the darwin one locally and run canrs --version through bin_path()), a
  formula that brew audits clean.
• Version appears in exactly the places the lockstep rule names: Cargo.toml, wheel, formula.