fix(release): brew token via .Env; version wording

[xe-nvdk]

Summary

• The first v26.09.1 run published the release (20 assets, cosign bundle) and the GHCR image, then failed at the Homebrew step: envOrDefault is not a template function in GoReleaser 2.18.1 (the token template is only evaluated at publish time, so no snapshot could catch it). The token is now {{ .Env.HOMEBREW_TAP_TOKEN }}; release.yml already refuses to start unless the variable is set and can read the tap.
• Version wording corrected: archives, image tags and arcli --version carry 26.09.1 verbatim; only the deb / rpm / Arch packagers normalise their version field to 26.9.1.

Test plan

• CI dry run passes locally; actionlint clean
• Published assets verified: sha256 OK, cosign verify-blob (cosign v3.1.3) "Verified OK" on a application/vnd.dev.sigstore.bundle.v0.3+json bundle, anonymous docker pull ghcr.io/basekick-labs/arcli:26.09.1 works, darwin archive runs
• Re-tag v26.09.1 on the merged commit; the rerun replaces assets, re-pushes images, re-signs, and pushes Formula/arcli.rb to the tap