fix(ci): harden Homebrew publish workflow auth and environment separation

[eschaar]

Summary

• switch Homebrew publish job gating to repository variables for valid job-level evaluation
• enforce required Homebrew dispatch signing secret before dispatch execution
• migrate tap authentication from PAT to GitHub App token flow
• align app token inputs to client-id naming
• isolate Homebrew publish job in dedicated homebrew environment

Why

• ensure workflow conditions are evaluated correctly at job level
• reduce credential risk by using short-lived GitHub App tokens instead of long-lived PATs
• fail fast when required signing configuration is missing
• separate Homebrew operational secrets from PyPI publish context for least-privilege handling

Version impact

• None
• Patch
• Minor
• Major