ci: automate Ori formula updates

[bjoerndanz]

Summary

• Adds a release-driven updater for Formula/ori.rb.
• Reconciles against the latest stable release each hour and on manual runs.
• Opens or updates one automation/update-ori pull request.
• Updates the current formula from 0.7.1+6fb9ea6 to 0.10.1+b41708f.

The updater reads version and SHA256SUMS from the immutable release. It stops if metadata is incomplete or the formula structure changes.

Flow

stable Ori release
  -> ori-released repository dispatch
  -> resolve releases/latest
  -> update version, URLs, and checksums
  -> run scripts/check
  -> open or update the formula PR

The hourly schedule repairs a missed dispatch. Every trigger resolves releases/latest, so a delayed event cannot downgrade the formula.

Required setup

Make these organization secrets available to OpenRouterLabs/homebrew-tap:

• ORI_RELEASE_GH_APP_CLIENT_ID
• ORI_RELEASE_GH_APP_PRIVATE_KEY

Install the release App on this repository. Give it contents: write and pull requests: write permissions.

Merge this PR before enabling the notifier in OpenRouterIncubator/ori#2236.

Verification

scripts/update-ori
# Formula/ori.rb is already current at 0.10.1+b41708f.

scripts/check
# Syntax OK (three Ruby scripts)
# update-ori tests passed
# 1 formula inspected, no offenses detected

The existing PR CI installs and tests Ori on macOS and Linux. I did not replace the local OpenRouterTeam/tap registration because Homebrew found a different registered remote.

Security

The formula uses immutable release URLs and pinned SHA-256 checksums. The workflow mints a token scoped to this repository and keeps the default GITHUB_TOKEN read-only.