Shell: Deliver the C/C++ toolchain lazily in guest

[brandonpayton]

Why

Kandelo's ordinary shell cannot currently build C or C++ programs in
guest. Shipping the full compiler in every boot image would make all
shell starts pay for a large payload, including sessions that never
compile code.

This change gives Node.js and browser hosts the same authenticated,
first-use toolchain while preserving a small, usable initial shell.
Failures remain visible and retryable, and GitHub Pages stays in
observe mode until protected publication and canary evidence exist.

What changed

• Select the kandelo-sdk Homebrew Formula as a lazy dependency of the
  normal shell. Its same-tap closure supplies Clang 21, libc++, and the
  Kandelo SDK.
• Expose cc, c++, and wasm32posix-* through the ordinary shell
  layout without fetching toolchain trees during boot.
• Add one worker-owned prefetch API to both Node.js and browser hosts.
  It derives the closure from the sealed descriptor, verifies each
  immutable tree before materializing it, and retries the same identity.
• Add the C development gallery preset. It opens the same shell, writes
  hello.c, and begins prefetch only after the terminal is usable.
• Require protected in-guest C and C++ compile-and-run evidence on both
  Node.js and Chromium before promotion and Pages readiness.
• Stage the new product root append-only while keeping the retired
  migration, selection, and artifact locks exact. Legacy closed lanes
  reject an unfinalized toolchain root instead of silently admitting it.
• Keep the Pages rollout observe-only and document delivery, failure,
  and current fork-instrumentation limits.

Validation

• Native kernel library tests: 1,249 passed.
• Full canonical host suite: 2,913 passed, 2 expected failures, and
  129 skipped across 269 passing and 28 skipped files.
• ABI snapshot and request-feed checks passed.
• Protected staging product evidence passed, including 39 Node
  toolchain cases and 168 host tests.
• Exact seven-product Pages assembly and all 5 Chromium integrity tests
  passed.
• Deferred-tree checks passed in Chromium, Firefox, and WebKit.
• The post-repair shell closure, finalizer, product-state, catalog,
  publish-workflow trust, and documentation-link checks passed.

The full local browser asset preparation cannot complete before the new
ABI 42 Homebrew artifacts are published: the public index does not yet
contain the required homebrew-bootstrap revision. The protected
post-merge canary is therefore the remaining browser acceptance gate.
No syscall, libc, process, or ABI semantics changed; POSIX suites were
considered but not rerun. Performance was not measured.

[github-actions]

Phase B-1 matrix build status — pr-1266-staging-run-31776142444-attempt-1

ABI v42. 0 built, 16 failed, 16 total.

Package	Arch	Status	Sha
homebrew-bootstrap	wasm32	failed	—
kandelo-sdk	wasm32	failed	—
mariadb-test	wasm32	failed	—
mariadb-vfs	wasm32	failed	—
mariadb-vfs	wasm64	failed	—
redis-vfs	wasm32	failed	—
rootfs	wasm32	failed	—
spidermonkey	wasm32	failed	—
node	wasm32	failed	—
shell	wasm32	failed	—
spidermonkey-node	wasm32	failed	—
lamp	wasm32	failed	—
nginx-php-vfs	wasm32	failed	—
nginx-vfs	wasm32	failed	—
node-vfs	wasm32	failed	—
wordpress	wasm32	failed	—

_{Auto-generated; replaced on each push. Raw data in the publish-status workflow artifact.}