Document the Homebrew release and release process

AGENTS.md

@@ -174,6 +174,14 @@ what we take vs. skip). Never vendor it into the build.
   4+32 KiB after.
 - No third-party deps beyond `github.com/coder/websocket` and
   `golang.org/x/crypto` (ACME); keep it that way unless a milestone calls for it.
+- **CLI release**: `v0.1.0` (tag on `ebae420`) is published on Gitea with
+  darwin/linux arm64+amd64 tarballs and `checksums.txt`. The Homebrew formula
+  is `tzgyn-tunnel` in `TZGyn/homebrew-tap` (it installs the `tunnel` binary;
+  the name avoids the deprecated core `tunnel` formula). Rebuild with
+  `-X main.version=<version>`, attach all four assets, and update the four
+  URLs/SHAs in the formula on each release. `tunnel up` currently starts a
+  detached process, not a launchd agent (the official CLI's agent was stopped
+  when the live tunnel was switched to this client).
 - Milestones: M1 core data path (done); M2 real ACME DNS-01 + renewals (done);
   M3 rate limits/admin/hardening (done); M4 Go client (done). Remaining optional
   work: export/import admin endpoints, token rotation, multi-region mesh,

README.md

@@ -52,6 +52,13 @@ go build -o .local/tunnel ./cmd/tunnel
 .local/tunnel status
 ```
 
+Or install the released binary (installs a `tunnel` command):
+
+```bash
+brew tap TZGyn/tap https://gitea.tzgyn.dev/TZGyn/homebrew-tap.git
+brew install tzgyn-tunnel
+```
+
 The first `route add` creates a tunnel, generates the P-256 key/CSR, waits for
 the certificate, starts the background service, and prints the public URL.
 Routes reload without restarting the service.