[dipto0321]

Summary

Corrects the tap_migrations.json format in the release checklist and
documents the two traps the v1.2.2 Homebrew tap migration actually hit.

The format was wrong

The checklist showed a nested object:

{ "Formula": { "nodeup": "Cask" } }

Homebrew's Tap#tap_migrations parses the file with JSON.parse(...)
and looks the name up directly, so the format is a flat
{old_name: new_name} hash. The nested form resolves to nothing and
the migration never fires.

Trap 1: the migration must land in one update cycle

The formula removal, the tap_migrations.json, and the cask all have
to land together. With the formula still present,
brew install dipto0321/tap/nodeup resolves to the formula
(Homebrew prints "Treating ... as a formula") — and the formula
install is the one that leaves the binary quarantined, so the cask's
quarantine-stripping hook would never reach users.

Trap 2: the cask checksums must come from the release

The cask's sha256 values must come from the release's own
checksums.txt, not from a local goreleaser --snapshot render. Go
builds are not byte-reproducible, so the snapshot hashes do not match
the published assets and the install fails with "Cask nodeup reports
different checksum".

Also updates docs/installation.md to say that brew update
performs the formula→cask hand-off automatically (it unlinks the old
keg, installs the cask, and asks you to
brew uninstall --formula --force nodeup), with the manual commands
for anyone who prefers to do it themselves.

Test plan

• The migration was verified end-to-end on a real machine: from a
  formula install, brew update detected the migration, unlinked
  the old keg, installed the cask, and the resulting binary came
  out with no quarantine attribute and ran 3/3 times.
• brew uninstall --formula --force nodeup left the cask install
  intact and nodeup version still worked.
• Docs-only change — go build ./..., go vet ./...,
  gofmt -l ., golangci-lint run ./..., go test -race ./...
  all pass.

🤖 Generated with puku-cli

[cocogitto-bot]

✔️ aabcbb5 - Conventional commits check succeeded.