Keep the Homebrew cask intact when its layout changes - #752

Make the release's Homebrew update survive changes Homebrew makes to the cask, and fail visibly when it cannot. This is the alternative to #747: the release job keeps opening its own bump PR, so the result is still immediate and the notifications still reach the PR's author, but the cask is no longer rebuilt by line number.

The step kept lines 1-3 and 7-33 of Casks/g/gitx.rb around a freshly written version and checksums. With one line added near the top (Homebrew last changed this cask in April, adding depends_on macos), it writes the intel: checksum line twice, which Ruby rejects as a syntax error, and the job still opens the pull request with it.

Changes

• Move the update into scripts/update-homebrew-cask.sh: it replaces only the version and the two checksums, wherever they sit in the file, and leaves everything else exactly as Homebrew keeps it. Being a script, it runs the same locally as in the release job.
• Fail the release job, leaving the cask alone, when those three values are not each found exactly once (for instance if Homebrew moves the checksums into on_arm/on_intel blocks), instead of sending a broken cask. A failed run notifies whoever pushed the tag.
• Keep the rest as is: the checkout of homebrew-cask, the PR template step and the PR itself are unchanged.

Test plan

Ran the old step and the script on today's cask (from Homebrew/homebrew-cask) with the 1.6 disk images, and on variants of it:

• Today's cask, same release: both leave it unchanged.
• One line added near the top: the old step writes a cask that fails ruby -c; the script changes exactly the three lines.
• A new release (1.7, other images): the script changes exactly the three values, and the result passes ruby -c and brew style.
• Both checksums on one line: updated in place.
• Checksums moved into on_arm/on_intel blocks, or the intel: line doubled: the script fails with a message and leaves the cask unchanged.