ci(homebrew): wait for release assets before bumping the formula

.github/workflows/homebrew.yml

@@ -31,6 +31,37 @@ jobs:
           token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
           path: tap
 
+      # This workflow and release-binaries.yml both fire on `release:
+      # published`, but the formula needs the tarballs that release-binaries
+      # produces. Wait for all three to be attached before proceeding, rather
+      # than racing it (which failed with "no assets to download").
+      - name: Wait for the release assets
+        env:
+          GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+          TAG: ${{ steps.v.outputs.tag }}
+        run: |
+          set -euo pipefail
+          needed="bbmctl-${TAG}-aarch64-apple-darwin.tar.gz \
+                  bbmctl-${TAG}-x86_64-apple-darwin.tar.gz \
+                  bbmctl-${TAG}-x86_64-unknown-linux-gnu.tar.gz"
+          # release-binaries.yml builds across four runners (~5 min); poll for
+          # up to ~15 minutes.
+          for _ in $(seq 1 45); do
+            assets=$(gh release view "$TAG" --repo "${{ github.repository }}" --json assets --jq '.assets[].name')
+            missing=0
+            for a in $needed; do
+              echo "$assets" | grep -qx "$a" || missing=1
+            done
+            if [ "$missing" -eq 0 ]; then
+              echo "all release assets present"
+              exit 0
+            fi
+            echo "waiting for release assets..."
+            sleep 20
+          done
+          echo "::error::timed out waiting for release assets on $TAG"
+          exit 1
+
       # This replaces dawidd6/action-homebrew-bump-formula, which cannot bump a
       # multi-platform pre-built-binary formula: `brew bump-formula-pr` expects
       # a single url/sha256, so it failed on every release (see #30). Rewriting