[Homebrew/Publisher] Secure and unblock tap-owned bottle builds

[brandonpayton]

Why

The trusted rootfs recovery lane could publish only Bash, Dinit, and M4. That hardcoded allowlist blocked valid tap-owned Formulae, while running tap code with the publisher's normal authority would expose its filesystem and credentials.

This PR keeps recipe execution isolated and adds a bounded authority decision so the remaining wasm32 Formulae can be published without weakening that boundary.

What changes

• Bind each sealed tap recipe, its source, environment, dependencies, resources, and exact files into a publisher attestation.
• Run tap-owned recipes as unprivileged, network-isolated services with a read-only filesystem allowlist, then seal and validate their output.
• Validate declared executable and side-module output roles before publication.
• Project Formula resources into the attested recipe instead of granting ambient filesystem access.
• Classify only cache-miss Formulae with the repository-pinned Ruby toolchain before the build matrix starts.
• Automatically admit direct Formula builds and sealed tap recipes. Keep the two remaining registry bridges explicit: modeset -> modeset and nethack -> nethack.
• Carry the complete classification record into each build and compare it again immediately before execution. A changed tap checkout therefore cannot switch a direct or sealed recipe into a broader registry bridge after provisioning.
• Cap the transported record at 65,536 bytes and 256 Formulae, and reject malformed, extra, mixed, or unsupported authority metadata.
• Reject rootfs-generation dry runs at the trusted caller boundary so a repository token is never exposed to branch-selected source.

Boundaries

This is packaging and publisher infrastructure only. It does not change the kernel, libc, ABI, shell image, demos, or host runtime, and it does not include the shell cutover from #1116.

The exact package generation supplies the fixed wasm32 Formula build/test runtime packages. It does not supply the target Formula's bottle, and the workflow builds the current-main SDK and sysroot separately. A temporary bridge still compiles Homebrew-verified source through an authenticated recipe owned by the exact Kandelo main commit.

Validation

• Focused Formula-authority selection and mutation tests
• Complete publisher trust checker
• Package-publish flow, CI scope, and exact-generation materializer suites
• Formula runtime-closure, patched-launcher, and sealed recipe-runner suites
• Complete provisioned publisher workflow suite
• Repository shell syntax and git diff --check
• Supplemental Actionlint and ShellCheck comparison
• Independent final publisher/security review: clean

Rollout after merge

1. Create and promote one fresh exact rootfs generation from the final merged main commit. Do not reuse the earlier b90eff73 generation or invoke an unmerged workflow SHA.
2. Rotate the tap caller and trust pins once to that immutable merged SHA.
3. Publish wave A concurrently: libmagic, make, wget, unzip, nano, NetHack, and Modeset.
4. After those dependencies are current, publish wave B: file-formula and zip.
5. Convert the two temporary registry bridges to sealed tap recipes in the tap follow-up; that conversion is not required for the first publication wave.

The existing Bash bottle was produced from already-merged authority and remains valid; this PR does not require rebuilding it.

The exact final head prepared for this PR is 0187ff08addb52c97fdae22d6d7c093645286bae on base b90eff73960207b59b7db55c7fb4ed46a4d075c0.

[github-actions]

prepare-merge: runtime/materialization tests passed against the synthetic PR merge; package staging and durable package publishing were skipped. merge-gate=success posted on PR HEAD. This PR is ready for a reviewer to rebase merge.