fix(ci): harden package-homebrew version extraction and SHA validation

[Copilot]

package-homebrew.yml had two gaps left from the workflow_run migration: version extraction silently accepted any head_branch value (including non-tag branch names), and the SHA uniqueness guard only covered the three binary assets, leaving completions, man pages, and source tarball downloads unchecked for 404 collisions.

Changes

• Version validation — both trigger paths now enforce semver format via grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+...':
  • workflow_run: exits with a descriptive error if head_branch isn't a vX.Y.Z tag ref
  • workflow_dispatch: strips an optional leading v, then validates the remainder before proceeding
• Expanded SHA uniqueness guard — check now covers all 6 assets (ARM64, AMD64, Linux, completions, man pages, source tarball); threshold raised from 3 → 6 unique values
• Robust unique-count — replaced wc -l with grep -c . to avoid off-by-one when sort -u output lacks a trailing newline

# Before: silently used branch name as version
VERSION="${RUN_HEAD_BRANCH#v}"

# After: validates tag format first
if printf '%s\n' "$RUN_HEAD_BRANCH" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+([0-9A-Za-z.+-]*)?$'; then
  VERSION="${RUN_HEAD_BRANCH#v}"
else
  echo "Error: workflow_run triggered from non-tag ref '$RUN_HEAD_BRANCH'." >&2
  exit 1
fi

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Pull request overview

This PR hardens the package-homebrew.yml workflow by adding validation to prevent silent failures when triggered with invalid version references, and expands asset integrity checks to cover all downloaded artifacts.

Changes:

• Added semver format validation for both workflow_run (tag-based) and workflow_dispatch (manual input) trigger paths
• Expanded SHA256 uniqueness verification from 3 binary assets to all 6 downloaded assets (binaries, completions, man pages, source tarball)
• Improved SHA counting robustness by replacing wc -l with grep -c . to avoid off-by-one errors