homebrew: trust same-tap dependencies during bottle builds

[brandonpayton]

Purpose

Allow the trusted Kandelo bottle publisher to evaluate dependencies supplied by the selected Homebrew tap without disabling Homebrew tap-trust enforcement or consuming persistent user state.

This is platform-owned publisher work in Automattic/kandelo; it changes no tap formula and must not be auto-merged.

Stack

This PR is intentionally stacked on #887 at exact parent 1e819fa6c02129698f9fd6fb0b528dca135bea86, which is itself stacked on #881. The current head is 0a23dfbc8d2752d5ecfb37d46ed5d0f9f0530649, and the PR base is fix/homebrew-publisher-prefix so review shows only this tap-trust change.

Merge order is #881, then #887, then this PR. After each parent lands, retarget the next PR to main. The tap-native under-lock composition work in #885 must be rebased onto this combined stack afterward.

Root Cause

Homebrew 6 trusts a fully qualified formula named on brew install, but it evaluates each dependency Formula separately. The current builder taps Automattic/kandelo-homebrew and installs the selected formula without trusting the tap, so a formula such as ncurses is accepted and its same-tap libcxx dependency is then rejected as untrusted.

Change

• create a temporary XDG Homebrew configuration store inside the read-only bottle build's existing work directory;
• select that store before any Brew invocation, including homebrew: preserve bottle compatibility for host build dependencies #887's repository and prefix discovery;
• trust the reviewed selected tap after brew tap and before Formula dependency evaluation;
• retain Homebrew's tap-trust boundary rather than setting HOMEBREW_NO_REQUIRE_TAP_TRUST;
• remove the store through the existing build cleanup and leave the caller's Homebrew configuration untouched;
• document this behavior only in ci: isolate and verify Homebrew bottle publication #881's read-only build-and-test role;
• add regression coverage for prefix discovery, tap/trust/install ordering, private directory permissions, cleanup, and caller-state nonmutation.

The isolated config is build-local data and does not cross #881's strict handoff. This PR does not change upload-bottle, verify-bottle, or the credentialed finalize-tap job.

#885 Coordination

After #881, Formula merging and under-lock tap composition live in a separate finalizer architecture rather than the former homebrew-bottle-build.sh --merge path described by the original #890 body.

When #885 is rebased, it must preserve this build-side trust behavior without assuming the XDG store crosses runner or artifact boundaries. Any Formula evaluation needed during refreshed under-lock composition must be designed separately within #881's token-isolation and inert-handoff contract; it must not expose finalizer credentials to Formula or artifact-provided code.

Validation

Current-head validation at 0a23dfbc8d2752d5ecfb37d46ed5d0f9f0530649, run through scripts/dev-shell.sh on aarch64-apple-darwin:

• bash scripts/test-homebrew-publish-workflow.sh: passed. This includes ci: isolate and verify Homebrew bottle publication #881's strict handoff and workflow-trust coverage, homebrew: preserve bottle compatibility for host build dependencies #887's launcher fixture, and the new tap-trust regression.
• bash -n scripts/homebrew-bottle-build.sh scripts/test-homebrew-publish-workflow.sh: passed.
• git diff --check 1e819fa6c02129698f9fd6fb0b528dca135bea86..HEAD: passed.
• The final PR delta is exactly three files. No reusable workflow, permission, handoff validator, uploader, verifier, or finalizer implementation changed.
• The range-diff against original head e875c3e3e2e3ac104536fe683aa569943786dc39 preserves the production tap-trust behavior and strengthens it for homebrew: preserve bottle compatibility for host build dependencies #887: the isolated XDG store now covers launcher discovery, and the fixture verifies cleanup and caller-state nonmutation.

Before the rebase, a real Homebrew 6.0.9 probe with an isolated XDG store reproduced formula-only trust rejecting automattic/kandelo-homebrew/libcxx and showed whole-tap trust allowing the same ncurses dependency resolution. The production trust operation remains the same, but that real-Homebrew probe was not repeated at the new commit.

A full bottle rebuild was not run locally. Hosted CI is rerunning for the rebased stack and remains required evidence before merge.

Contract Scope

This changes trusted Homebrew build tooling and documentation. It does not change the Kandelo ABI, kernel, host runtime, Node/browser behavior, Formula Ruby, package artifacts, VFS images, or binary indexes.

[github-actions]

Phase B-1 matrix build status — pr-890-staging

ABI v18. 69 built, 0 failed, 69 total.

Package	Arch	Status	Sha
libcurl	wasm32	built	b16dfa55
libcxx	wasm32	built	a6a226bf
libcxx	wasm64	built	05cc04c6
libpng	wasm32	built	fb0072b7
libxml2	wasm32	built	7693dffe
libxml2	wasm64	built	0e9bdba6
openssl	wasm32	built	6079e850
openssl	wasm64	built	96e12f2f
sqlite	wasm32	built	5079ecc6
sqlite	wasm64	built	41e589af
zlib	wasm32	built	02809e96
zlib	wasm64	built	74a9b521
bc	wasm32	built	e10365d5
bzip2	wasm32	built	78f873f3
coreutils	wasm32	built	198092d9
curl	wasm32	built	db51ebb0
dash	wasm32	built	01910f46
diffutils	wasm32	built	c730ca1d
dinit	wasm32	built	7fa2cfc1
fbdoom	wasm32	built	0560d7dc
file	wasm32	built	0285fc03
findutils	wasm32	built	7d4a601c
gawk	wasm32	built	69d7773b
git	wasm32	built	de2da6a2
grep	wasm32	built	41d5f22d
gzip	wasm32	built	cf0f7b2f
hello	wasm32	built	0e7165f9
kandelo-sdk	wasm32	built	911d8907
kernel	wasm32	built	3a942356
less	wasm32	built	a926fd81
lsof	wasm32	built	9415a3e3
m4	wasm32	built	f653ae19
make	wasm32	built	9cba934d
mariadb	wasm32	built	efe83b04
mariadb	wasm64	built	8238b3ea
modeset	wasm32	built	54395757
msmtpd	wasm32	built	418b5b1b
nano	wasm32	built	35094cd6
ncurses	wasm32	built	95f1807e
netcat	wasm32	built	bc14b930
nginx	wasm32	built	b728d91a
php	wasm32	built	1100861d
posix-utils-lite	wasm32	built	2ba7af8b
ruby	wasm32	built	646b371d
sed	wasm32	built	4bb4d852
spidermonkey	wasm32	built	5e0492a5
tar	wasm32	built	b41c7bad
tcl	wasm32	built	889ee16d
unzip	wasm32	built	54d97756
userspace	wasm32	built	325ab8bf
vim	wasm32	built	8e11f39b
wget	wasm32	built	88792aab
xz	wasm32	built	f9fecf97
zip	wasm32	built	c26954c3
zstd	wasm32	built	8fed2df5
bash	wasm32	built	28a7bea0
mariadb-test	wasm32	built	02fd8177
mariadb-vfs	wasm32	built	9cc3a58b
mariadb-vfs	wasm64	built	f5340c57
nethack	wasm32	built	86fd6eea
node	wasm32	built	abc37eda
spidermonkey-node	wasm32	built	121e7aa3
vim-browser-bundle	wasm32	built	abedb1b1
nethack-browser-bundle	wasm32	built	2b1fabb6
rootfs	wasm32	built	3cb8e7f3
shell	wasm32	built	fe1e6492
lamp	wasm32	built	8f3681cb
node-vfs	wasm32	built	929cf9bb
wordpress	wasm32	built	1bb5f5a5

_{Auto-generated; replaced on each push. Raw data in the publish-status workflow artifact.}

[brandonpayton]

Superseded by #936, which retains this PR as patch-equivalent purpose commits in the consolidated Homebrew publisher batch and reruns the combined validation on current main.