[Homebrew/Security] Accept reviewed native build requirements during bottle publication

[brandonpayton]

Why

Asa uses two reviewed native build tools from the tap's sealed Formula support code. The post-build source check counted every KandeloFormulaSupport reference and therefore mistook those ordinary requirement declarations for extra source loading. Asa built and tested successfully, but publication stopped before uploading anything.

What changes

• Recognize only the exact static depends_on KandeloFormulaSupport::<Name>Requirement => <literal tags> source shape as a reference into the support tree that is already part of the verified source closure.
• Keep the Ruby AST parser authoritative for where the declaration may appear, which requirement classes exist, which tags are valid, and whether each class has the canonical support definition.
• Continue rejecting dynamic lookup such as KandeloFormulaSupport.const_get(...), extra source loaders, extra Tap.fetch calls, and require_relative.
• Document the ownership boundary and add WHY comments beside it.
• Cover Asa's exact scalar :build plus [:build, :test] shape and the dynamic-reference failure case.

Validation

• bash scripts/dev-shell.sh bash scripts/test-homebrew-publish-workflow.sh
• bash -n scripts/homebrew-validate-formula-source-closure.sh scripts/test-homebrew-oci-layout.sh scripts/test-homebrew-publish-workflow.sh
• git diff --check
• Independent security review confirmed that source-shape recognition does not expand requirement authority.

This PR is stacked on #1084. The next proof is the exact Ubuntu preflight, followed by a one-package Asa canary before any parallel rollout.

[brandonpayton]

CI status is understood:

• Exact Ubuntu preflight is green at d3805721b887a19382ef1c96b576fc27badc0951 (run 30093832821, job 89483115245), including the full publisher-trust contract.
• change-scope and test-gate-validation are green.
• Downstream test-gate-prepare failed at the known ABI 42 bootstrap boundary: the canonical binaries-abi-v42/index.toml release does not exist yet, so fetch-only materialization resolved 0/74 packages after the release URL returned 404. This is the catalog this rollout is currently producing, not an H13 source-validation failure.

The tap trust rotation is now merged, and fresh Asa-only run 30094542074 is validating the corrected publication path before the parallel rollout continues.

[brandonpayton]

Live canary evidence is now complete for exact head d3805721b887a19382ef1c96b576fc27badc0951:

• tap run: 30094542074
• exact caller tap head: edeebd60813fd8aceded35b93e4c36c211232b18
• Asa build + Formula tests: green
• post-build reviewed-source recheck (the prior H12 failure point): green
• public bottle upload and complete version index: green
• anonymous exact-index traversal, exact-byte receipt validation, force-pour, and Formula execution: green
• dependency-bearing Node.js and Chromium image proof: green
• atomic tap finalization: green at tap commit acea6d62608a441e68d4ffb153b9ec7c4045d64f

publish-vfs-release was intentionally skipped because this was an Asa-only bottle canary with require-vfs-acceptance: false; Python remains the selected VFS acceptance root.

The controller stopped before the parallel wave on a separate tap-side continuation issue: aggregate metadata correctly rolled over to the current ABI42-only catalog, while the controller still looked there instead of at durable per-Formula sidecars for implicit versions. No wave dispatch occurred; that general controller fix is being handled separately in the tap.