chore(release): drop the Homebrew tap job + install.tracebloc.io promise

[LukasWodka]

What

WS-F.5 of the customer-surface truth pass (epic tracebloc/backend#1106). Decision recorded on the epic (Lukas, 2026-07-14, OQ2): drop both the Homebrew tap and the install.tracebloc.io vanity URL. GitHub Releases plus the cosign-verified install.sh are the install path — stop advertising anything else.

Changes

• .github/workflows/release.yml — delete the disabled bump-homebrew-tap job (was lines 224–291, incl. its comment block — the ticket's ~225–290 range verified against the actual file) and the header bullet promising an optional tap bump.
• scripts/homebrew-formula.rb.tmpl — deleted.
• README.md — line 13 no longer promises a tap or vanity URL; it now states plainly that GitHub releases + the cosign-verified install.sh are the install path. Roadmap row 5 annotated "(Homebrew tap dropped — WS-F.5: drop Homebrew job/template + install.tracebloc.io promise (APPROVED) #299)".
• scripts/RELEASE_CHECKLIST.md (straggler cleanup from the repo-wide grep) — removed the tap step from the automatic list, the "Homebrew tap repo" + "Vanity install URL" one-time-setup sections, the tap verify bullet, and the brew install tracebloc/tap/tracebloc sanity-test path; replaced with a short note recording the decision.

Kept deliberately (not distribution promises): the brew install cosign pre-install hint (README:72, install.sh), delete.go's brew-managed-binary uninstall hints + tests, and RFC-0001 history.

Everything deleted is recoverable from git history if a customer ever asks for a tap.

Verification

• python3 -c "yaml.safe_load(...)" on release.yml — parses clean; remaining jobs (release, publish) untouched.
• go build ./... green (no Go code touched).
• Repo-wide grep for homebrew-tap / install.tracebloc.io / HOMEBREW_TAP / tracebloc/tap — only remaining hit is the RELEASE_CHECKLIST note recording the decision.

Note: a sibling PR (#296 truth pass) is based on this branch and also edits README.md / RELEASE_CHECKLIST.md — merge this one first.

Fixes#299

🤖 Generated with Claude Code

---

Note

Low Risk
Documentation and removal of an already-disabled workflow job; no changes to binary build, signing, or install scripts.

Overview
Aligns docs and CI with the decision that GitHub Releases + cosign-verified install.sh are the only supported install path (#299).

CI: Removes the disabled bump-homebrew-tap job from release.yml (formula render, SHA fetch, push to tracebloc/homebrew-tap) and the header comment about an optional tap bump. release / publish jobs are unchanged.

Repo cleanup: Deletes scripts/homebrew-formula.rb.tmpl. README no longer mentions a future Homebrew tap or install.tracebloc.io; phase 5 in the roadmap notes the tap was dropped. RELEASE_CHECKLIST drops tap one-time setup, tap verify steps, and brew install tracebloc/tap/tracebloc from sanity tests, replaced by a short decision note.

^{Reviewed by Cursor Bugbot for commit 1f9a4ae. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 37 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#181 — feat(weights): normalize-on-read — mixed cycles average instead of rejecting (SEC-03 §8 step 2) · author: @shujaatTracebloc · no reviewer assigned
• averaging-service#182 — feat(weights): averaging writes SafeTensors (TF + PyTorch) — SEC-03 §8 step 4 · author: @shujaatTracebloc · no reviewer assigned
• backend#1079 — feat(global_meta): edge dataset_meta exposure + attributes contract at ingest (#924 G4a) · author: @divyasinghds · no reviewer assigned
• backend#1086 — docs(rfc): SafeTensors weight-format migration — SEC-03 Phase 1 (RFC 0004) · author: @shujaatTracebloc · no reviewer assigned
• backend#1093 — chore(deps): bump django from 5.2.14 to 5.2.15 · author: @dependabot · no reviewer assigned
• backend#1095 — feat(experiment): configurable preprocessing knobs incl. tabular scaler — RFC 0003 L1 + L1b (#1094) · author: @LukasWodka · no reviewer assigned
• backend#1100 — fix(boot): pin SDK install to tracebloc==0.11.2, drop 404 dev line (#1098) · author: @LukasWodka · reviewer: @saqlainsyed007
• backend#1105 — perf(api): query micro-fixes — notifications N+1, cached data_scientist, composite index, sampling (#975) · author: @aptracebloc · no reviewer assigned
• cli#266 — main - > enhance CLI features and tests · author: @saadqbal · no reviewer assigned
• cli#278 — fix(deps): toolchain go1.26.5 + x/net v0.57.0 — clear 6 reachable vulns; govulncheck CI gate · author: @LukasWodka · reviewer: @saadqbal

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[LukasWodka]

@BugBot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 1f9a4ae. Configure here.}

[saadqbal]

Clean cleanup — verified nothing else references the deleted bump-homebrew-tap job (only needs: release remains), so release.yml structure is intact. 👍