[Homebrew/Validation] Keep fork imports under the shared ABI contract

[brandonpayton]

Why

Kandelo adds a generated import surface when it instruments a
WebAssembly program for fork(). The shared artifact validator reads
that generated ABI contract. It checks the imports, their signatures,
the memory width, and the required exports together.

Dinit and Redis also audited unresolved build imports after
instrumentation. That forced each Formula to duplicate the generated
fork names. Those lists can drift when the fork contract changes, and
Dinit rejected a correct ABI 42 artifact after shared validation had
already proved the fork surface valid.

Moving the unresolved-import audits before instrumentation preserves
their useful protection against broken build inputs. It also leaves
generated fork imports under the one validator that owns their ABI.

What changed

• Move Dinit's unresolved-import audit before fork instrumentation.
• Move Redis's equivalent audit before instrumentation and retain its
  dynamic-loader imports.
• Keep generated fork imports and signatures under
  kandelo_validate_wasm_artifact.
• Add a tap-wide regression that rejects post-instrumentation import
  parsing or Formula-local __wpk_fork_* names.
• Add WHY comments beside the ordering and ownership decisions.

Current stack

This draft is one commit atop tap #129:

• [Homebrew/Packages] Build seven programs from sealed tap recipes #129 head
  82b620bd0135e44a73b6f9e6837a736e27cf07ed;
• this PR head
  0a5f97b16f70ebd495e0d454db6376badaa06a57;
• resulting tree
  9d143c86b566478faa9be7cbb7a987c0b32f1a44.

The restack preserved the Dinit patch exactly:

• the old and new stable patch ID is
  8bed8827bddb3ad0bdd03905f0025b5d4c3341c7;
• git range-diff reports the commits as equal;
• Git's independent merge-tree result is
  9d143c86b566478faa9be7cbb7a987c0b32f1a44, matching this tree;
• only Dinit, Redis, and the shared support regression differ from
  [Homebrew/Packages] Build seven programs from sealed tap recipes #129.

Validation

Local and repository checks passed:

• focused Formula-support checks: 6 tests, 175 assertions;
• the regression identifies Dinit and Redis on the parent tree;
• strict Ruby syntax for both Formulae and the support test;
• publisher workflow trust validation;
• git diff --check;
• [Homebrew/Validation] Keep fork imports under the shared ABI contract #103's base-sensitive publisher-trust check.

Redis passes Homebrew style. Dinit retains three pre-existing findings:
dependency order, bottle-block placement, and one trailing class blank
line. The exact #129 base reports the same three findings.

The fresh exact-head dry run used this PR head and
Kandelo source
85d2efccdf55f02eb23fde4e9a3d075a4b267104. Planning, source
validation, the Dinit source build, and its Node checks passed. The run
then stopped at the new sealed-Vite boundary before Chromium with:

Tier-2 source builds require a valid publisher attestation

That Kandelo commit predates #1138, which seals and attests the exact
Vite closure required by #129. This is the expected central-runtime
dependency, not a Dinit failure. The tap contract remains strict and
will be rerun after #1138 lands.

The pre-restack dry run passed the complete Dinit build
and Formula test against the same Kandelo source and the identical
Dinit patch. It passed:

• the Dinit source build and bottle composition;
• a credential-free force-pour of the exact local dry-run handoff;
• Dinit's complete Formula test on Node and Chromium;
• fresh source rechecks, sidecars, and the validated data-only handoff.

Neither dry run published or anonymously downloaded a new package.
Public readback remains part of the later write publication.

Rollout

Keep this PR draft and unmerged while the central runtime lands:

1. Land Kandelo #1138 and rerun [Homebrew/Packages] Build seven programs from sealed tap recipes #129's seven-package validation first.
2. Merge [Homebrew/Packages] Build seven programs from sealed tap recipes #129 after that exact validation is green.
3. Retarget and rebase this commit onto exact tap main.
4. Prove the resulting tree is unchanged and rerun the base checks.
5. Rerun Dinit against the sealed-Vite Kandelo source.
6. Merge this tap-only change and publish Dinit.
7. Require public anonymous readback, brew test, Node and Chromium
   execution, sidecars, and Formula finalization.

Dinit is independent of the seven Formulae in #129. Its later
publication does not invalidate their artifacts or publication state.

[brandonpayton]

Closing as superseded by #155.

The sole patch in this draft has stable patch ID
8bed8827bddb3ad0bdd03905f0025b5d4c3341c7, exactly matching the
corresponding patch already present on main through #155. No unique
change remains to land.