fix(ci): validate Homebrew formula version

[alxxjohn]

Motivation

• The workflow previously embedded the extracted internal/version/version.go value directly into a double-quoted Ruby Homebrew formula string, which allowed PR-controlled interpolation (e.g. #{...}) to be evaluated when Homebrew loaded the formula.
• The extractor was widened to accept var Number declarations which made untrusted PR content reach the Ruby sink; this change prevents unsafe values from being written into the formula.

Description

• Add semantic-version validation to .github/workflows/homebrew-validation.yml so the version extracted by scripts/version-from-source.sh must match a standard semver pattern before the formula file is generated.
• If the extracted value does not match the semver regex the job prints an error and exits, preventing malicious payloads (including Ruby interpolation) from reaching the generated formula.
• The regex accepts normal versions, prerelease identifiers, and build metadata so valid releases continue to work unchanged.

Testing

• Ran go test ./... and test packages passed.
• Parsed the updated workflow YAML with a Ruby YAML loader using ruby -e 'require "yaml"; YAML.load_file(".github/workflows/homebrew-validation.yml", aliases: true)' which succeeded.
• Verified bash scripts/version-from-source.sh yields 0.1.0 and that the new regex accepts it, and that a malicious payload like #{system 'id'} is rejected by the validation.
• Ran git diff --check and YAML/format checks to ensure the change is well-formed.

---

Codex Task