[Homebrew] Project attested Formula resources into sealed recipes

[brandonpayton]

Why

Formula-owned tap recipes can already build from Homebrew's verified primary source and poured dependency kegs. They could not safely receive an ordinary Homebrew resource without either accepting a caller-selected host path or folding that resource into the primary source closure.

This adds a bounded build-time resource projection to the sealed schema-3 publisher contract. It is stacked on #1112 at exact base fd0ae3aa79011370f5200211fccbfaf01fcbe8e1.

What changes

• Parse an optional sorted resources: ["name"] list without evaluating Formula Ruby, and bind each selected resource to one literal HTTPS URL and SHA-256.
• Independently validate and attest the same resource identities in the Rust preflight.
• Accept only the exact helper-owned kandelo-package-resources/<name> layout in the privileged runner.
• Snapshot resource trees into root-owned, read-only projections at /kandelo/resources/<name>.
• Reject missing/extra resources, symlink escapes, concurrent mutation, post-validation directory replacement, duplicate normalized names, and dependency/resource/script-environment collisions.
• Raise the bounded schema-3 control document limit from 16 KiB to 64 KiB so the maximum 32-resource declaration remains representable.
• Document the build-time projection, size limits, provenance, and licensing contract.

This does not change Node or browser runtime behavior. Resources are visible only to the isolated bottle recipe while it builds.

Validation

Head: 72875c93966bd1d2f4c9538647cb6de10b6ae69b

• scripts/dev-shell.sh bash scripts/test-homebrew-publish-workflow.sh — passed end to end.
• PYTHONDONTWRITEBYTECODE=1 python3 scripts/test-homebrew-tap-recipe-runner.py — 25 tests passed (3 host-specific skips locally; 2 skips in the Nix publisher run).
• scripts/dev-shell.sh cargo test --target <host> -p xtask homebrew_tier2_preflight -- --nocapture — 30 passed, 560 filtered out.
• scripts/dev-shell.sh bash scripts/test-homebrew-formula-runtime-closure.sh — passed.
• scripts/dev-shell.sh bash scripts/test-homebrew-patched-launcher.sh — passed, including the read-only live resource canary.
• scripts/dev-shell.sh ruby scripts/check-homebrew-publish-workflow-trust.rb — passed.
• Exact fbdoom Formula plan → Rust schema-3 attestation — passed with only the selected chocolate-doom resource.
• Exact main-shell closure validation inside the full suite — 21/21 Node tests passed.

[brandonpayton]

Superseded by #1121. Its exact patch is preserved there as commit 198cc28 (stable patch ID d018e056e87f96c5adeabaeff1d6104d100a666b), so keeping this draft open would duplicate review and CI.