[Epic] Distribute Fallout via native package managers (winget, Homebrew, .deb)

[ChrisonSimtian]

Epic

Distribute Fallout via the native package manager on each supported OS — both the fallout CLI (the .NET global tool, Fallout.GlobalTools, command fallout) and the fallout-agent deployment daemon (RFC #113) — so users and operators get a native, upgrade-managed install instead of a curl-piped tarball or manual dotnet tool steps.

Why

The package manager is the install contract users care about: native install/upgrade/removal, and — for the agent daemon — signed provenance and service registration. Two artifacts with different shapes ride this:

• fallout CLI — framework-dependent global tool; brew/winget/apt install + upgrade without the manual dotnet tool dance.
• fallout-agent — signed, self-contained daemon; adds notarization/codesigning and native service (launchd/systemd/Windows service) registration.

Each artifact × platform is a separate parent story.

Children

• As a Windows operator I can install fallout-agent via winget #121 — Windows / winget (agent)
• As a macOS operator I can install fallout-agent via Homebrew #122 — macOS / Homebrew (agent)
• As a Linux operator I can install fallout-agent via apt #123 — Linux / .deb (agent)
• As a macOS user I can install the fallout CLI via Homebrew #496 — macOS / Homebrew (the fallout CLI — sibling of As a macOS operator I can install fallout-agent via Homebrew #122)

Cross-cutting concerns (deferred — track via comments here, not new stories yet)

• Versioning policy. Does the package-manager-published version always match Nerdbank.GitVersioning's MajorMinorPatchVersion, or do we strip prerelease tags for stable channels only?
• Pre-release channels. winget supports preview manifests, Homebrew taps can have --HEAD, .deb repos can have separate unstable suites. Out of scope until stable channels are shipping.
• Cert / key custody. Authenticode cert (Build signed MSIX installer for fallout-agent #125), Apple Developer ID + notarytool credentials (Codesign and notarize fallout-agent macOS binary #131), and project GPG key (GPG-sign .deb packages and publish key fingerprint #136) each need a documented rotation + custody plan. Likely one tracking issue once the rotation pattern is clear, not three. (Agent-only — the CLI ships unsigned via its runtime.)
• Recurring cost. Authenticode cert (~$200/yr+), Apple Developer Program ($99/yr), and any paid APT hosting (Cloudsmith etc.) add a non-trivial bill. Worth surfacing before sign-off.

Related

• RFC [RFC] CD deployment agent/runner — lightweight, forge-agnostic, idle-and-wait #113 — CD deployment agent/runner
• RFC [RFC] Continuous Delivery: Fallout as a release-management platform #106 — Continuous Delivery vision