[mstomar125]

Closes #2171.

What changed

scripts/update-homebrew-cask.ts still carried a full Intel code path that could no longer be exercised after #2169 dropped x86_64 macOS from release CI. This collapses the generator to match:

• ArchDigest.arch collapsed from "arm" | "intel" to "arm"; ARCH_SUFFIX: Record<"arm"|"intel", string> replaced with a single ARCH_SUFFIX_AARCH64 constant; ArchDigestResult.intel? dropped.
• resolveArchDigests() resolves only the Apple Silicon .dmg and now throws a hard error if it's missing, instead of reporting it in a non-fatal missing: string[] array — there's no other architecture left to fall back to.
• renderCask() keeps exactly one rendering path (top-level url/sha256 + depends_on arch: :arm64); the on_arm/on_intel two-architecture branch is gone.
• main() no longer prints the ⚠ missing release assets warning on a normal arm64-only release.
• The rationale (why Apple Silicon is the only target, that it's reversible, what re-adding an architecture would involve) is now a comment on ArchDigest, matching the pattern in publish-install-script.ts.
• The header docblock no longer claims the script is unwired/manual — it now describes release.yml's sync-homebrew-cask job (gated on build-tauri-macos-arm, --push with HOMEBREW_TAP_TOKEN, notify-failure on failure) and homebrew-drift-check.yml as a scheduled backstop.
• A stale comment in release.yml's sync-homebrew-cask job (describing the old tolerant/non-fatal behavior) is corrected to describe the new hard-fail behavior.

Byte-identical verification (acceptance criterion)

Confirmed directly, not assumed: rendered renderCask("v0.2.0", ...) with the real published sha256 (b19edf954ae0...) and diffed against a live fetch of NodeSpaceAI/homebrew-nodespace's Casks/nodespace.rb via gh api repos/NodeSpaceAI/homebrew-nodespace/contents/Casks/nodespace.rb. Output is byte-for-byte identical — same sha256 -a 256 checksum on both files. (This required updating the generator's comment constants to match the tap's actual published wording, which had drifted from the old generator's single-arch output even before this change — now they're pinned together, and a new test (matches the published tap's Casks/nodespace.rb byte-for-byte for v0.2.0) locks it in.)

Tests

• scripts/update-homebrew-cask.test.ts: both-architecture test case and Intel fixtures removed; added a byte-for-byte assertion against the live published cask content and a "no x64/on_intel trace" assertion.
• bun run test:scripts: 110 pass, 0 fail.

Test plan

• scripts/update-homebrew-cask.ts has no intel/x64 code path
• A missing Apple Silicon .dmg fails loudly (hard error) rather than rendering a cask with no URL
• No ⚠ missing release assets warning on a normal arm64-only release
• renderCask() output verified byte-identical to the published Casks/nodespace.rb for v0.2.0 (diff + sha256 match)
• Tests updated; both-architectures test and Intel fixtures removed; bun run test:scripts passes
• Comment records why Apple Silicon is the only target and what re-adding one would involve
• Header docblock rewritten to describe the actual sync-homebrew-cask wiring
• bun run quality:fix clean; full pre-push gate (scripts/test-gate.ts) passed clean, including cargo test -p nodespace-app (ADR-048 Tauri-seam suite)
• Adversarial review (general-purpose subagent) ran against the real diff — no blockers; one real finding (stale release.yml comment) addressed in a follow-up commit

🤖 Generated with Claude Code