Publish Homebrew cask, add landing page, release from the changelog

[fadeltd]

Summary

• Homebrew cask. Each stable release pushes Casks/pdfunlock.rb to fadeltd/homebrew-tap, so macOS users can run brew install --cask fadeltd/tap/pdfunlock.
  • GoReleaser pushes over SSH with a deploy key (HOMEBREW_TAP_DEPLOY_KEY, already configured). Prereleases are skipped.
  • The binary isn't notarized, so the cask removes com.apple.quarantine after install.
  • That uses postflight_steps through custom_block, because Homebrew 7 deprecates the postflight block GoReleaser's hooks generate. GoReleaser puts custom_block first, so brew style reports Cask/StanzaOrder; this is cosmetic.
• Release from the changelog, as in xiaomi-debloater:
  • release.yml now runs on merge to main. It picks the next version from ## [Unreleased]: Breaking → major, Added → minor, anything else → patch.
  • It commits the dated section as Release vX.Y.Z [skip ci], pushes the tag, and dispatches publish.yml.
  • publish.yml is the old tag-triggered workflow, now dispatch-only. It runs GoReleaser on the tag, with that version's changelog section as the release notes.
  • It sets GORELEASER_PREVIOUS_TAG explicitly, because the existing tags aren't ancestors of main.
  • The logic lives in scripts/release, a port of xiaomi-debloater's script with tests. It reads the current version from the newest changelog section.
  • make release VERSION=… now pushes the tag and dispatches Publish, for hand-made prerelease tags.
• CI (ci.yml):
  • Fails a PR that changes the tool without a changelog entry. Docs, *.md, .github/, scripts/, Makefile and env.sample are exempt, and the skip-changelog label skips the check.
  • Runs gofmt, vet, tests, build and goreleaser check.
• Landing page. A static page in docs/ for GitHub Pages at https://fadeltd.github.io/pdfunlock/.
• Housekeeping:
  • Pin Go 1.26.8, and have workflows read .go-version.
  • Fix the Windows download name in the release notes.
  • Add the missing 1.0.1 changelog entry.
  • Bump actions to match xiaomi-debloater.
  • Ignore tmp/.

Merging this releases v1.1.0, because [Unreleased] has an ### Added section.

Testing

• go test ./... passes (release script). actionlint and goreleaser check are clean.
• Ran go run ./scripts/release -dry-run on the real changelog. It gives minor, 1.0.1 -> 1.1.0, with the expected notes.
• Simulated the release in a throwaway clone:
  • applied the release and tagged v1.1.0;
  • ran GoReleaser with --skip=publish and the same notes and previous-tag handling as Publish;
  • GoReleaser used previous=v1.0.1 current=v1.1.0, and the cask came out at 1.1.0.
• Snapshot cask on the real repo: correct archive URLs, and a separate sha256 for each OS and architecture.
• Installed the cask from a local test tap on Apple Silicon. With postflight_steps, the quarantine attribute is removed and pdfunlock --version runs.
• Checked the landing page at desktop and 375px widths, in light and dark mode, and against WCAG AA contrast.