v2.4.2

ci: fix brew style violations in generated cask (#9)

## Summary
\`brew test-bot\` is failing on \`abizer/homebrew-tap\` master ([run
25410956395](https://github.com/abizer/homebrew-tap/actions/runs/25410956395))
because the v2.4.1-generated \`Casks/nssh.rb\` has two RuboCop offenses:

1. \`Style/IfUnlessModifier\` — multi-line \`if OS.mac?\` for a single
statement. Rewritten as modifier-if.
2. \`Layout/EmptyLinesAroundBlockBody\` — blank line before the cask's
closing \`end\`, courtesy of goreleaser's \`# No zap stanza required\`
placeholder. Replaced by a real \`zap.trash\` stanza listing the dirs
nssh writes locally (\`~/.local/state/nssh\`, \`~/.config/nssh\`).

## Test plan
- [ ] Merge → cut a \`patch\` release (v2.4.2) → confirm goreleaser
pushes a fresh \`Casks/nssh.rb\` to the tap
- [ ] \`brew test-bot\` on the tap goes green
- [ ] On macOS: \`brew install --cask abizer/tap/nssh\`; \`nssh\`
launches without Gatekeeper alert; \`brew uninstall --cask --zap nssh\`
cleans up local state

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Low risk: only adjusts GoReleaser Homebrew cask generation to satisfy
`brew style`, without changing app runtime behavior beyond uninstall
cleanup metadata.
> 
> **Overview**
> Updates `.goreleaser.yaml` to change the generated Homebrew cask: the
post-install quarantine removal hook is rewritten as a single-line
modifier `if OS.mac?` to satisfy RuboCop.
> 
> Adds an explicit `zap.trash` section (listing `~/.local/state/nssh`
and `~/.config/nssh`) to avoid GoReleaser emitting the `# No zap stanza
required` placeholder that was causing `brew style` empty-line
violations.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
f88fc8bff30a35649abe4b1946992fcb5538bdbb. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

v2.4.1

ci: migrate goreleaser brews to homebrew_casks (#8)

## Summary
- `brews:` is being phased out by goreleaser ([deprecation
notice](https://goreleaser.com/deprecations/#brews)). The v2.4.0 release
log warned about this.
- Renames the section to `homebrew_casks:`, drops the formula-only
fields (`directory`, `license`, `install`, `test`), and adds a
post-install hook that strips `com.apple.quarantine` so unsigned darwin
binaries actually launch on modern macOS.

## Follow-up (in `abizer/homebrew-tap`)
- Add `tap_migrations.json` mapping `nssh` → cask, and delete the old
`Formula/nssh.rb` so existing `brew upgrade nssh` users land on the
cask.

## Test plan
- [ ] Cut a `patch` release via Actions → release → Run workflow;
confirm goreleaser publishes a cask to `abizer/homebrew-tap` under
`Casks/nssh.rb`
- [ ] `brew install --cask abizer/tap/nssh` on macOS, then `nssh` runs
without the "damaged / cannot be opened" Gatekeeper alert

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Low risk: release packaging config change only, but it can affect
macOS install/upgrade behavior if the tap expects a formula vs cask or
the post-install hook misbehaves.
> 
> **Overview**
> Updates GoReleaser Homebrew publishing from deprecated `brews` to
`homebrew_casks` for `nssh`, removing formula-specific fields
(`directory`, `license`, `install`, `test`).
> 
> Adds a macOS-only post-install hook to strip the
`com.apple.quarantine` xattr from the staged binary so the downloaded
(non-notarized) app can launch without Gatekeeper blocking.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
4c11a84028b2ffbac411bb03025e5bd7e4e9df80. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

v2.4.0

ci: add workflow_dispatch release trigger (#7)

## Summary
- Adds `workflow_dispatch` to `release.yml` with a `bump:
patch|minor|major` choice input
- Computes the next semver from the latest `v*` tag, tags HEAD, and
pushes — then goreleaser runs in the same job (so no PAT needed;
`GITHUB_TOKEN`-pushed tags don't trigger downstream workflows)
- Existing `push: tags` path is preserved for manual `git push origin
vX.Y.Z`
- Guarded so dispatch only runs from `master`

## Test plan
- [ ] Actions → release → Run workflow on `master` with `bump=patch`
produces the next tag and a goreleaser run
- [ ] Manual `git tag vX.Y.Z && git push --tags` still triggers the
existing path

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Changes the release pipeline to create and push git tags
automatically, which can unintentionally cut releases or bump the wrong
version if misused. Risk is somewhat mitigated by restricting manual
dispatch runs to `master` and keeping the existing tag-push trigger.
> 
> **Overview**
> Adds a manual `workflow_dispatch` trigger to the `release` GitHub
Actions workflow with a `bump` input (`patch|minor|major`).
> 
> On manual runs, the workflow now computes the next `v*` semver tag
from the latest existing tag, creates and pushes that tag (guarded to
only run from `master`), then proceeds with the existing
GoReleaser-based release flow; the original `push: tags` trigger remains
unchanged.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
eae184a0d24e72646f119ce9a68e92c49134819f. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

v2.3.0

nssh v2.3.0: status subcommand, unified wire events

v2.2.0

nssh v2.2.0: ntfy read deadlines + one-shot remote prep

v2.1.0

nssh v2.1.0: release via goreleaser

v2.0.1

Full Changelog: v2.0.0...v2.0.1

v2.0.0

Full Changelog: v1.4.0...v2.0.0

v1.4.0

Full Changelog: v1.3.0...v1.4.0

v1.3.0

Full Changelog: v1.2.1...v1.3.0