docs(cli): document Homebrew tap trust for third-party tap installs (#483)

Homebrew will require explicit trust for non-official taps in a future
release (6.0.0 or 5.2.0, whichever comes first). The existing
'brew install --cask mozilla-ai/tap/cq' is fully-qualified and already
trusts only that cask, so it keeps working; this note makes that explicit
and documents 'brew trust --cask' for users who tap first and install by
short name.

Author: peteski22

cli/README.md

@@ -23,6 +23,14 @@ cd cq/cli
 make build
 ```
 
+> **Homebrew tap trust:** `mozilla-ai/tap` is a third-party tap, and Homebrew will require explicit [tap trust](https://docs.brew.sh/Tap-Trust) for non-official taps from versions 5.2.0 and 6.0.0 onwards. Installing by the fully-qualified cask name (`mozilla-ai/tap/cq`, as above) trusts only the `cq` cask, so that command keeps working without extra steps. If you prefer to tap first and install by short name, trust the cask explicitly:
+>
+> ```bash
+> brew tap mozilla-ai/tap
+> brew trust --cask mozilla-ai/tap/cq
+> brew install --cask cq
+> ```
+
 ## Usage
 
 ```bash