[Homebrew] Prove sealed shell inputs through deployed transport

[brandonpayton]

Why

The Homebrew shell is authorized by an immutable bottle selection and
a sealed shell-artifact lock. Release checks must continue to validate
those authorities when the product moves from a pending source catalog
to its sealed selection.

The browser proof must also use the same external Cross-Origin Resource
Sharing (CORS) proxy as deployed Pages. The clean development shell
drops ambient workflow variables by design. Without explicit
forwarding, it can drop a strict Playwright input and let the acceptance
test skip instead of proving the deployed transport.

This affects maintainers deciding whether the exact shell bytes are safe
to publish, and users who expect the deployed browser to retrieve and
run those same bytes.

What changed

• Make release-lock and finalizer checks derive the checked-in product
  phase and selected Ruby dependency shape.
• Bind the mirror and Pages Chromium proofs to the production CORS
  proxy.
• Forward all 12 strict Pages product inputs through the development
  shell.
• Add one rejection mutation for every input that must not be dropped.

Node and Chromium still consume the same sealed product identities. The
change hardens workflow admission and transport; it does not change the
kernel, Application Binary Interface (ABI), package recipes, package
revisions, bottle bytes, or package indexes.

Validation

The following passed from the exact branch head
024569c7ed1605570991b574aeccf8b53445717c, based directly on protected
main commit af80a443a6b4820e3b04845a64ab5cb8854638cd:

python3 .github/scripts/test-check-homebrew-main-shell-release-locks.py
python3 scripts/test-finalize-homebrew-main-shell-release.py
bash scripts/test-homebrew-main-shell-product-state.sh
bash scripts/test-homebrew-main-shell-mirror-workflow.sh
bash scripts/test-pages-deployment-contract.sh
bash scripts/test-homebrew-main-shell-closure.sh
ruby scripts/check-homebrew-publish-workflow-trust.rb

The shell-closure suite included 48 passing Node subtests with no
failures or skips. The browser-asset check passed its Pages contract
tests, then stopped at package resolution because this fresh clone had
no fetched canonical Wasm or package generation. No broader
browser-asset resolution claim is made.

Remaining evidence

The protected synthetic-merge gate must pass against this exact head.
Actual external-proxy Chromium lifecycle and deployed Pages evidence
remain mandatory after the sealed selection and public mirror exist. A
real proxy availability failure must remain visible.

Merge boundary

Do not merge while the active C13 migration scheduler still requires
Kandelo main to remain at
af80a443a6b4820e3b04845a64ab5cb8854638cd. Once that bounded migration
operation is complete, apply the readiness label and obtain fresh
staging and prepare-merge evidence for this exact head.

[github-actions]

prepare-merge: runtime/materialization tests passed against the synthetic PR merge; package staging and durable package publishing were skipped. merge-gate=success posted on PR HEAD. This PR is ready for a reviewer to squash merge.