homebrew: materialize the Formula test base runtime

[brandonpayton]

Purpose

Make the isolated Homebrew bottle build job materialize the real Kandelo shell-script runtime before it executes Formula tests. This lets installed scripts such as UnZip's zipgrep run through Dash, Grep, Sed, and Coreutils inside Kandelo instead of relying on wrappers, false Formula dependencies, or test-side downloads.

Platform contract

• Resolve dash, coreutils, grep, and sed through the authoritative Kandelo package resolver with --fetch-only.
• Materialize those programs into the read-only build job before Homebrew executes Formula code.
• Always resolve the base runtime as wasm32. These dependency-free program manifests default to wasm32, and the host resolver intentionally maps unqualified guest program paths to wasm32 even when a bottle matrix entry builds wasm64.
• Keep these registry artifacts scoped to the Kandelo platform runtime. The package under test must still be built or poured as a Homebrew bottle; registry resolution is not accepted as bottle evidence.
• Extend the publisher trust checker so source fallback, architecture drift, package-set drift, and step-order drift fail closed.

No package recipe, binary archive, release index, kernel/runtime behavior, or ABI changes in this PR.

Stack

Base PR: #885 (fix/homebrew-tap-native-sidecars)

Base SHA: d2696657d0a75a66c1b6bacbf7e346a2769f27a2

Head SHA: 480b19c3a8143accf5a737d307a51df9d788cdb6

Validation

On the exact head through scripts/dev-shell.sh:

• the full reusable Homebrew publisher workflow test passed
• the publisher trust checker passed, including its self-mutation cases
• workflow YAML parsed and embedded shell passed syntax validation
• git diff --check passed
• an independent review accepted the workflow topology, fixed wasm32 architecture, exact package set, ordering, job isolation, and documentation

Integration gate

This is a dependent PR, not yet merge-ready. The current durable ABI 18 index still points at archives built before #881 added Ruby to the declared dev shell and preserved the Homebrew commit input. Those files are intentional global package cache inputs, so every package key changed. Exact --fetch-only resolution correctly rejects all four stale entries:

Package	Required key	Durable index key
dash	01910f463bc9...	8e44c509ada8...
coreutils	198092d95768...	5c8ca2eca5af...
grep	41d5f22d49f5...	f48bb3c92452...
sed	4bb4d852b0e5...	3e1bae0577b0...

PR #885's staging run is already rebuilding the exact current graph successfully under the new keys. After the publisher stack lands, the supported durable release workflow must rebuild/promote the ABI 18 graph, then this PR's exact four-package fetch and Homebrew runtime tests must be rerun. The implementation intentionally does not permit source fallback while that gate is unresolved.

[brandonpayton]

Exact staged-artifact integration evidence at head 480b19c3a8143accf5a737d307a51df9d788cdb6:

Using the supported resolver override

WASM_POSIX_BINARY_INDEX_URL=https://github.com/Automattic/kandelo/releases/download/pr-881-staging/index.toml

I ran the workflow's exact cargo run --release -p xtask ... build-deps --arch wasm32 --binaries-dir <isolated-dir> --fetch-only resolve <package> operation for Dash, Coreutils, Grep, and Sed through scripts/dev-shell.sh.

All four downloaded, verified, and materialized successfully at the exact required keys:

• Dash 01910f463bc9... -> programs/wasm32/dash.wasm
• Coreutils 198092d95768... -> programs/wasm32/coreutils.wasm
• Grep 41d5f22d49f5... -> programs/wasm32/grep.wasm
• Sed 4bb4d852b0e5... -> programs/wasm32/sed.wasm

This proves the implementation against #881's real staged archives without permitting source fallback. It does not convert staging assets into a durable-release or bottle claim. #881's reviewed prepare-merge promotion remains the required durable gate before this PR is merge-ready.

[brandonpayton]

Hosted run 29188197872 failed exactly at the documented durable-artifact gate.

test-gate-prepare did not execute the new Homebrew materialization step or any runtime suite. Because this stacked PR has no package-recipe diff, the generic staging workflow selected binaries-abi-v18; every one of the 69 enabled graph entries then rejected the pre-#881 durable cache key under --fetch-only (11 known packages were explicitly skipped). test-gate failed only because preparation failed.

This is consistent with the independently pinned global cache-input change and with #881 staging: the exact four runtime tools already resolve successfully from pr-881-staging, while durable resolution rejects them. No source fallback will be enabled to make this stacked run appear green. After #881's reviewed prepare-merge promotes the full current graph, rerunning this head should exercise the actual suites; until then this PR remains dependent and not merge-ready.

[brandonpayton]

Superseded by #936, which retains this PR as patch-equivalent purpose commits in the consolidated Homebrew publisher batch and reruns the combined validation on current main.