fix: Move the quarantine hook ahead of completion generation

[masutaka]

Follow-up to #351. Installing v4.3.1 via the new cask popped the Gatekeeper dialog and installed no completions.

RuntimeError: Failed to generate bash completions from .../github-nippou:
  `{"SHELL"=>"bash"} .../github-nippou completion completion bash`
  was terminated by uncaught signal KILL

Two separate bugs in one line of output.

1. The hook fired too late

Homebrew orders cask artifacts by class, not by the order they appear in the Cask file. From abstract_artifact.rb:

PreflightBlock,          # ← the fix
...
[Binary, CommandWrapper],
[BashCompletion, FishCompletion, ZshCompletion],
GeneratedCompletion,     # runs the binary
PostflightSteps,
PostflightBlock,         # ← was here

GeneratedCompletion executes the binary to produce completions, and it runs before PostflightBlock. So the xattr -dr com.apple.quarantine never got a chance — Gatekeeper killed the process with SIGKILL first.

GoReleaser's cask template has a comment claiming it emits postflight before generate_completions_from_executable for exactly this reason (goreleaser#5958), but textual order is irrelevant once Homebrew sorts.

PreflightBlock runs before everything else, and staged_path already exists by then — Installer#install calls stage before install_artifacts.

2. args was wrong from the start

shell_parameter_format: cobra already makes Homebrew append completion <shell> (shell_completion.rb):

when :cobra
  ["completion", shell_parameter]

Adding args: [completion] on top produced completion completion bash. This one is nastier than it looks, because it does not fail:

command	output
completion completion bash	827 bytes of cobra help text, exit 0
completion bash	16573 bytes, the actual script

Without the Gatekeeper crash, broken completion files would have been installed silently.

Also dropped shells

It was pinned to bash/zsh/fish only to match the old Formula. The cobra default adds pwsh, which works here: cobra emits PowerShell completions, and the cask side supports them — SUPPORTED_SHELLS = [:bash, :zsh, :fish, :pwsh] in generated_completion.rb. PowerShell runs on macOS and Linux too.

The whole stanza is now one line.

Generated cask

  binary "github-nippou"

  preflight do
    if OS.mac?
      system_command "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "#{staged_path}/github-nippou"]
    end
  end

  generate_completions_from_executable "github-nippou",
    shell_parameter_format: :cobra

Verification

• make release-check passes
• make dist emits preflight and a single-argument generate_completions_from_executable
• After release: brew upgrade on a machine with v4.3.1 installed, confirm no Gatekeeper dialog and that completions land in $(brew --prefix)/share

[masutaka]

Verified on v4.3.2. brew upgrade completed with no Gatekeeper dialog and no RuntimeError.

==> Upgrading github-nippou
  4.3.1 -> 4.3.2
==> Unlinking Binary '/opt/homebrew/bin/github-nippou'
==> Linking Binary 'github-nippou' to '/opt/homebrew/bin/github-nippou'
🍺  github-nippou was successfully upgraded!

All four completion files landed:

 16573  /opt/homebrew/etc/bash_completion.d/github-nippou
  8000  /opt/homebrew/share/zsh/site-functions/_github-nippou
 10337  /opt/homebrew/share/fish/vendor_completions.d/github-nippou.fish
 11016  /opt/homebrew/share/pwsh/completions/_github-nippou.ps1

The bash file is 16573 bytes rather than the 827 bytes of cobra help text that completion completion bash used to write, so the argument fix is confirmed too. pwsh is there because shells is gone.

xattr -l on the staged binary shows only com.apple.provenance — the preflight hook cleared the quarantine bit before GeneratedCompletion ran.