This PR adds a well-structured Homebrew tap integration with formula template, CI workflow, and local testing. The workflow properly depends on binary builds, uses environment-scoped secrets, and includes verification steps. The formula template follows Homebrew conventions. Two minor improvements suggested: use idiomatic Homebrew DSL in the install block and improve signal handling in the test script.

packaging/brew/formula.rb.tmpl (line 18): Consider using on_arm? instead of Hardware::CPU.arm? for consistency with the on_arm/on_intel blocks above. The idiomatic Homebrew DSL would be:

def install
  bin.install "aleph-cli-macos-aarch64" => "aleph" if on_arm?
  bin.install "aleph-cli-macos-x86_64" => "aleph" unless on_arm?
end

This is more concise and consistent with the rest of the formula.

packaging/brew/test-local.sh (line 25): The trap only catches EXIT, so Ctrl+C (SIGINT) or process termination (SIGTERM) won't trigger cleanup. Consider adding these signals:

trap cleanup EXIT INT TERM

This ensures the formula is uninstalled and temp directory removed even if the script is interrupted.

.github/workflows/release.yml (line 315): Consider adding a permissions block to explicitly declare the workflow's permissions, consistent with the publish-apt job which has contents: write. While not strictly necessary (the job doesn't write to the source repo), it's good practice for clarity.