Label Homebrew CI archive downloads

[bpopadiuk]

Implemented by Codex.

Summary:

• create an ephemeral runner-local curl config for tap CI
• validate that the config path is absolute, mode 0600, and contains exactly one X-Antfly-Audience: ci header
• scope HOMEBREW_CURLRC only to an explicit forced formula archive fetch
• preserve Homebrew's normal user agent for channel attribution
• fully qualify the intended formula fetch/install/test target so it is not confused with the same-named cask
• leave all formulas and casks unchanged

The header is a caller-asserted metric label only and does not authorize access or prove CI identity.

Validation:

• actionlint and YAML parsing pass
• a real local brew fetch --force --formula completed with the scoped curl config
• git diff --check passes
• the earlier hosted run successfully fetched the formula archive, then exposed a pre-existing artifact problem: Homebrew cannot rewrite libantfly.dylib because its Mach-O header lacks install-name padding
• the new focused fetch step is independently visible before the unchanged install/test steps