feat(dist): publish to native package managers (winget, scoop, brew, choco, AUR)

[artyomsv]

Problem

Install today is a curl | sh one-liner (Linux/macOS), a manual .zip download (Windows), or go install. Every one of these asks the user to do something unusual before they have any reason to trust the project.

The Windows path is the worst of the three — "download a zip from Releases, extract anywhere on PATH" is a multi-step manual operation, and it is the platform where Quil has the most differentiated work (bundled OpenConsole, ConPTY hosting, reboot-proof restore).

Why this is cheap

The artifacts already exist. .goreleaser.yml cross-compiles five targets (linux/amd64, linux/arm64, darwin/amd64, darwin/arm64, windows/amd64), packages quil + quild together as .tar.gz/.zip, and publishes SHA-256 checksums to the GitHub Release. Package manifests are metadata pointing at those existing URLs and hashes — the build work is done.

Scope

Per-manager, roughly in order of impact:

• winget — microsoft/winget-pkgs PR per release. Highest value: it is the only Windows path that is not "download a zip".
• Homebrew — own tap (artyomsv/homebrew-quil) first; core formula later if adoption justifies it. Covers macOS and Linuxbrew.
• Scoop — own bucket. Cheapest of the Windows two, JSON manifest.
• Chocolatey — nuspec + install script.
• AUR — quil-bin PKGBUILD pointing at the release tarball.

GoReleaser has native publishers for Homebrew taps, Scoop buckets, and winget manifests — most of this is .goreleaser.yml config plus a token with push rights to the tap/bucket repos, not new tooling.

Constraints

• The Windows archive bundles OpenConsole.exe + conpty.dll (MIT, Microsoft). Manifests must carry the third-party attribution — see THIRD_PARTY_LICENSES.md. winget and Chocolatey both have fields for this.
• Two binaries per archive (quil + quild). Manifests that assume one executable per package need explicit handling so findDaemonBinary() still resolves — it checks PATH then the executable's own directory, so both must land in the same place or both on PATH.
• The release workflow already pushes tags with GITHUB_TOKEN, which does not trigger other workflows. Manifest publishing must run inside the existing goreleaser job, not as a separate tag-triggered workflow.
• Version bumps are automated from conventional commits. Manifest updates must be part of that same automated path or they will silently drift behind the actual latest release.

Success check

On a clean Windows 11 box with no Go toolchain: winget install quil then quil launches the TUI and auto-starts the daemon. Same for brew install artyomsv/quil/quil on a clean macOS box.