docs(adr-0056): Scoop+Homebrew validated; record the Caddy HEAD fix

Amendment 3: scoop install and brew install both verified end-to-end on
real Windows + macOS (install + run), resolving Amendment 2's unverified
caveats (incl. the HEAD:main push).

Records the root cause + fix for the Homebrew 403: Gitea (>=1.25)
303-redirects release downloads to a method-bound SigV4 presigned S3 URL;
brew resolves with HEAD, captures the HEAD-signed URL, then GETs it -> 403
(GET-only tools are unaffected). Fixed by a server-side Caddy rule that
answers HEAD on release-download paths directly (200, no redirect) so the
download GET re-runs the redirect fresh. That rule lives in the Gitea edge
config, NOT this repo - documented so a server rebuild doesn't silently
break brew. Includes the reference Caddyfile block.

Also notes the ad-hoc mac signature runs fine via brew; Developer-ID +
notarization stays parked on the Apple org conversion. Remaining D3: winget.

docs/requirements.md

@@ -86,14 +86,18 @@ since ADR-0027.)
 - [ ] **D3** Released via prebuilt binaries plus Homebrew, Scoop,
   `winget`, and `cargo binstall`.
   *(Prebuilt binaries + checksums on Gitea releases (D1); **`cargo
-  binstall` + crates.io live** (ADR-0056); **Scoop + Homebrew wired**
-  (ADR-0056 Amendment 2) — `publish.yaml` `scoop-bucket` /
-  `homebrew-tap` jobs render dependency-free manifests from the release
-  `.sha256` sidecars and push them, via the scoped `lazyeval-ci` bot
-  token, to `lazyeval/scoop-bucket` and `lazyeval/homebrew-tap`;
-  rendering covered by `scripts/test-package-renders.sh`, end-to-end
-  install still to be user-verified. **Remaining: winget** (komac on
-  Linux CI, or a manual PR). Asset naming
+  binstall` + crates.io live** (ADR-0056); **Scoop + Homebrew wired and
+  validated end-to-end** on real Windows + macOS (ADR-0056 Amendments
+  2 & 3) — `publish.yaml` `scoop-bucket` / `homebrew-tap` jobs render
+  dependency-free manifests from the release `.sha256` sidecars and push
+  them, via the scoped `lazyeval-ci` bot token, to
+  `lazyeval/scoop-bucket` and `lazyeval/homebrew-tap`; rendering covered
+  by `scripts/test-package-renders.sh`. NB: the Homebrew path depends on
+  a **server-side Caddy rule** answering HEAD on release-download paths
+  directly (Gitea's presigned-S3 redirect is method-bound and brew
+  reuses a HEAD-signed URL for its GET) — see ADR-0056 Amendment 3;
+  that rule lives in the Gitea edge config, not this repo. **Remaining:
+  winget** (komac on Linux CI, or a manual PR). Asset naming
   `rdbms-playground-<tag>-<target>` is binstall-friendly.)*
 
 ## TUI shell