chore(release): push the Homebrew cask with a deploy key (#31)

Replace the HOMEBREW_TAP_TOKEN PAT with HOMEBREW_TAP_DEPLOY_KEY, a
write-enabled SSH deploy key scoped to only AdrianBonpin/homebrew-gridline.
actions/checkout's `ssh-key` input wires the key into the SSH agent for the
job, so the cask push goes over SSH and no broadly-scoped personal access
token has to be stored as a repository secret.

Also drops the now-wrong claim that the job no-ops until the secret is set.

.github/workflows/release.yml

@@ -24,7 +24,10 @@ name: Release
 #
 # The cask bump runs only after the draft release is PUBLISHED (the GitHub
 # releases/tags API does not serve drafts), so it is wired to the `release:
-# published` event rather than the tag push. It also needs HOMEBREW_TAP_TOKEN.
+# published` event rather than the tag push. It pushes with a write-enabled
+# deploy key scoped to ONLY the tap repo (HOMEBREW_TAP_DEPLOY_KEY), so no
+# broad personal access token is stored — the default GITHUB_TOKEN cannot
+# push to a different repository.
 
 on:
   push:
@@ -421,9 +424,10 @@ jobs:
   # render Casks/gridline.rb from the template, and push it. Users then get
   # the new version via `brew upgrade --cask gridline`.
   #
-  # Requires the HOMEBREW_TAP_TOKEN secret (a PAT with `repo` scope on the tap
-  # repo — the default GITHUB_TOKEN cannot push to a different repo). The job
-  # no-ops until that secret is set, so releases stay green before this is
+  # Requires the HOMEBREW_TAP_DEPLOY_KEY secret — a write-enabled SSH deploy
+  # key on the tap repo (the default GITHUB_TOKEN cannot push to a different
+  # repository, and a deploy key avoids storing a broad PAT). The job skips
+  # cleanly until that secret is set, so releases stay green before this is
   # configured.
   bump-cask:
     # Triggered by `release: published`, NOT the tag push: the GitHub
@@ -434,15 +438,15 @@ jobs:
     permissions:
       contents: read
     steps:
-      - name: Check for tap token
+      - name: Check for tap deploy key
         id: tap
         shell: bash
         run: |
-          if [ -n "${{ secrets.HOMEBREW_TAP_TOKEN }}" ]; then
+          if [ -n "${{ secrets.HOMEBREW_TAP_DEPLOY_KEY }}" ]; then
             echo "enabled=true" >> "$GITHUB_OUTPUT"
           else
             echo "enabled=false" >> "$GITHUB_OUTPUT"
-            echo "::notice::HOMEBREW_TAP_TOKEN not set - skipping Homebrew cask bump."
+            echo "::notice::HOMEBREW_TAP_DEPLOY_KEY not set - skipping Homebrew cask bump."
           fi
 
       - name: Checkout
@@ -467,7 +471,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: AdrianBonpin/homebrew-gridline
-          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+          ssh-key: ${{ secrets.HOMEBREW_TAP_DEPLOY_KEY }}
           path: tap
 
       - name: Render and push cask