feat(release): adopt goreleaser and expand distribution channels (brew / npm / go install)

[1ncursio]

Summary

Portal currently ships through a single channel — a curl | bash (or PowerShell iex) one-liner that pulls from GitHub Releases. This roughly covers Linux and Windows, but macOS users expect brew, Go users expect go install, and cross-platform users expect npm. We discussed diversifying install channels (like tauri does) in portal-space on 2026-04-17.

This issue tracks the work to adopt goreleaser for a unified release pipeline and expand distribution to five channels.

Current State

Channel	Status	Notes
Linux install.sh	✅ Shipped	cmd/portal-tunnel/installer/install.sh
Windows install.ps1	✅ Shipped	cmd/portal-tunnel/installer/install.ps1
Homebrew	❌ Missing	Expected by macOS users
npm	❌ Missing	Cross-platform fallback
go install	⚠️ Unverified	Module path needs verification
goreleaser config	❌ Missing	.github/workflows/cd.yml releases manually

Decision

Adopt goreleaser for the entire release pipeline. Keep the existing install.sh / install.ps1 (they are the de facto standard on Linux/Windows now). apk, deb, and rpm are out of scope.

Scope

P0 — goreleaser foundation

• Add .goreleaser.yaml — multi-platform/arch build, archive, checksum, changelog
• Replace release step in .github/workflows/cd.yml with goreleaser/goreleaser-action
• Align install.sh / install.ps1 asset naming with goreleaser conventions
• Verify go install github.com/gosuda/portal-tunnel/cmd/portal-tunnel@latest works

P1 — new channels

• Homebrew — configure brews block in goreleaser, set up homebrew-portal tap
• npm — binary wrapper package with a postinstall script that downloads the platform binary from GitHub Releases
• Secrets: HOMEBREW_TAP_GITHUB_TOKEN, NPM_TOKEN

P2 — docs

• Update README.md Quick Start with all 5 install methods
• Add install channel matrix to the docs site (follow-up to RFC: Documentation Site & Strategy #193)

Depends on

• In-progress tunnel TUI (bubble tea) work — release changes land after that

Out of Scope

• apk / deb / rpm — no demand
• Scoop / Chocolatey / AUR — separate issue, later discussion

Done When

• A tag push via goreleaser publishes to all 5 channels automatically
• README Quick Start documents all 5 install methods
• Existing install.sh / install.ps1 paths remain backward-compatible