[Kernel/Homebrew] Land ABI 42 before activating the bottled shell

[brandonpayton]

Why

Kandelo needs ABI 42 before it can run the new ABI 42 Homebrew bottles. That
creates an ordering problem: the platform must land before the bottled shell can
become the default, but the browser demos must remain bootable during the
transition.

This PR lands the ABI 42 platform and keeps the current shell available through
a temporary source-built image. It deliberately does not switch the demos to
Homebrew bottles yet. That cutover follows after this exact change is on
main.

What changes

Make fork, catch, and spawn state activation-owned and bounded

• make the kernel process table the source of truth for task identity;
• replace fixed fork-continuation scratch storage with bounded linked frames;
• keep ordinary WebAssembly catch state owned by the function invocation that
  created it, including recursive calls;
• pass the exact saved continuation authority into child launch instead of
  deriving an address from global scratch state;
• validate continuation ownership and wasm32/wasm64 pointer geometry before
  allocating a child; and
• copy the complete posix_spawn input through bounded, reusable kernel-owned
  storage with pointer, range, and ARG_MAX checks.

These are platform fixes, not Bash- or package-specific workarounds.

Strengthen package and VFS boundaries

• reject stale or structurally invalid fork-instrumented Wasm;
• validate package archives and extract requested members through one bounded,
  path-safe implementation;
• keep lazy and eager package-tree behavior on the same validated VFS path;
• bind package generations, indexes, and publication writes to explicit source
  and authority identities; and
• fail closed when release state, package provenance, or retry state cannot be
  proven.

Keep the shell bootable while bottles are finalized

• build the current rootfs shell closure from source through the normal package
  resolver;
• keep the always-needed shell eager and preserve the current shell product
  contract, including lazy utilities and supporting trees; and
• continue exercising the same image through Node.js and browser hosts.

This source-shell bridge is intentionally temporary and is covered as such by
tests and documentation.

What happens to the pre-merge ABI 42 packages?

The exact 15-package rootfs closure produced by commit
748c2609954d2809bbcbbcb642fa7d257fc0dbc6 is preserved in a public,
content-addressed, application-sealed release. Its tag points directly to that
commit, all 18 release assets were anonymously read back and matched byte for
byte, and the manifest says admission: none.

That release is evidence, not a claim that the packages were built from
main.

After this PR merges, a separate packaging change will rederive the selected
rootfs build-input closure from the actual merge commit. It may create an
admitted generation only when the package projection, expected ledger, and
component inputs are exactly identical. Any difference requires a rebuild. The
larger browser package set is not covered by that equivalence and will not be
silently reused.

What this PR does not do

• It does not activate the mostly-lazy bottled shell.
• It does not make brew available inside the demo yet.
• It does not publish or rotate the final tap configuration.
• It does not label pre-merge package bytes as built from main.

Those are the next packaging and product steps after ABI 42 is on main.

Keep browser programs in one trusted cache

The exact source-built shell leaves browser programs in a temporary package
cache. Package fetching, the Vite build, and the sealed browser preview must all
use that same cache. If one phase silently falls back to another cache, Vite
correctly rejects the resulting symlink instead of serving a file from outside
its approved root.

The CI-only child commit f913f22b20b95de0687e308a5cea0f6fd477a5dd
passes one runner-local cache through every producer and browser consumer in
both source and bottle modes. It does not widen Vite access, change a package
identity, or change kernel behavior. The reviewed kernel/package head
f9bcfae2787c2687427bf1d41544637cdb4a9714 remains its direct parent.

Validation

Evidence already run on the combined candidate includes:

• ABI snapshot and generated libc/TypeScript binding checks;
• the complete fork-instrument suite and kernel-focused tests;
• wasm32/wasm64 continuation geometry and malformed-authority regressions;
• the real previously failing Nginx fork artifact, including HTTP 200 and 404
  child paths;
• host-runtime tests plus focused Chromium continuation coverage;
• all Sortix spawn cases, including repeated environments larger than 64 KiB;
• package-generation, durable publisher, archive extraction, workflow trust,
  source-shell closure, and deployment contract suites; and
• Node.js and browser consideration for every shared host-runtime change.

The final exact-head CI result will be recorded here before merge. Because this
changes the kernel and ABI, it will not merge without explicit approval of that
exact green head.

Final exact-head evidence

The final reviewed head is f913f22b20b95de0687e308a5cea0f6fd477a5dd; its direct parent is the reviewed kernel/package head f9bcfae2787c2687427bf1d41544637cdb4a9714. Current main is 4c0ec4a3629d00dd2f62aeef0b7177431ed5c2f7, and GitHub synthetic merge 2e080a5312fd9f56c1d4a45eab9c84b61522abdf has those exact ordered base/head parents.

Fresh evidence on that exact head/merge is green:

• staging run 30188135451;
• exact shell run 30188135455: forced source closure, one-cache browser inputs, exact installation, sealed product build, Node boot, Chromium shell boot, and fresh-process MODESET; image SHA-256 ec67d372822f8352cd18def1c4ab84229906bca3255166654ce99b01e9832b01;
• Prepare run 30188160612: all 76 archive promotions, candidate Homebrew startup, libc, POSIX, Sortix, Vitest, browser, final test gate, and merge gate; and
• scripts/check-abi-version.sh on both exact head and live synthetic merge: ABI snapshot, libc header, and generated TypeScript bindings are current, with the snapshot change correctly paired to the ABI 41 → 42 bump.

Prepare published the sealed 80-asset candidate release merge-candidate-abi-v42-pr-1097-run-30188160612-attempt-1 (release ID 359930157) targeted at the exact head. The CI-only child changes no package archive or cache-key identity.

Merging still requires explicit kernel approval and must use a merge commit so the exact reviewed head remains in main ancestry.

[github-actions]

prepare-merge: test-gate passed against the synthetic PR merge and sealed merge-candidate-abi-v42-pr-1097-run-30185008038-attempt-1. The canonical ABI index is unchanged. merge-gate=success was posted on PR HEAD. This PR is ready for a reviewer to squash merge; default-branch reconciliation will verify the exact merged tree before activation.

[github-actions]

prepare-merge: test-gate passed against the synthetic PR merge and sealed merge-candidate-abi-v42-pr-1097-run-30188160612-attempt-1. The canonical ABI index is unchanged. merge-gate=success was posted on PR HEAD. This PR is ready for a reviewer to merge merge; default-branch reconciliation will verify the exact merged tree before activation.