Add cloud-sim formula to the tap

[ShahriarAhnaf]

Summary

Add a cloud-sim formula to this tap, alongside the existing simantic formula, so the cloud-sim CLI can be installed with brew install simantic-dev/simantic/cloud-sim instead of being passed around as a file.

Motivation

cloud-sim (currently 0.1.0) runs simantic simulations in the cloud — auth, run and job subcommands, sharing ~/.sim_id with sim, pyrite's sim and analog-cli.

Today it is distributed as a bare binary shared over a file link. That has two practical problems:

• Gatekeeper. The binary is ad-hoc signed (TeamIdentifier=not set), so a browser download stamps com.apple.quarantine and macOS refuses to launch it. Every recipient has to manually xattr -d com.apple.quarantine cloud-sim, which trains people to bypass Gatekeeper.
• No integrity check. Nothing tells a recipient whether the bytes they received are the bytes that were published.

Installing through the tap addresses both: Homebrew fetches via curl, which does not apply the quarantine attribute, and the formula's pinned sha256 makes a mismatched or swapped artifact fail loudly at install time.

Prerequisites

This is blocked on publishing the binary — the formula cannot be written until these exist:

• cloud-sim published to the release bucket under a versioned path, matching the layout simantic already uses (releases/cli/<version>/<rid>/...zip)
• sha256 recorded for each published artifact

Proposed formula

Follow Formula/simantic.rb as-is: on_macos / on_linux blocks, url + sha256 per platform, bin.install "cloud-sim", and odie on unsupported architectures.

Note the current build is Mach-O thin arm64, so on day one the formula should odie for Intel macOS and for Linux, exactly as simantic.rb does, until other builds are produced.

Acceptance criteria

• brew install simantic-dev/simantic/cloud-sim succeeds on Apple Silicon
• cloud-sim --version runs with no quarantine prompt and no manual xattr step
• brew upgrade picks up a version bump
• Unsupported platforms fail with a clear message rather than installing a broken binary

Out of scope

Developer ID signing and notarization are worth doing separately, and are not required for this issue — the sha256 pin covers artifact integrity for tap-based installs. Signing mainly buys origin identity and clean browser downloads.

Reproducible CI builds are also tracked separately: pinning a sha256 makes an artifact immutable, not reproducible.