[Homebrew/Packages] Build seven programs from sealed tap recipes

[brandonpayton]

Why

Seven shell and demo programs still get their build recipes from
Kandelo's legacy package registry. This change makes each Homebrew
Formula and its tap-owned recipe the complete, reviewable source of its
build instead.

The publisher verifies recipe inputs and mounts them read-only. Some
upstream build systems write generated files into their source tree, so
those builds need a private writable copy. That copy must not weaken the
authenticated source boundary.

Homebrew also treats Formula#system differently from Ruby's
Kernel.system: it raises on failure and returns nil on success. The
old support code treated that successful nil as a failure.

What changes

• Build bc, fbdoom, lsof, modeset, netcat, nethack, and
  posix-utils-lite from sealed Kandelo/recipes/<name> manifests.
• Give each recipe only its declared source, resources, platform files,
  tools, and package dependencies.
• Copy the bc, fbdoom, netcat, and nethack sources into
  recipe-owned scratch space before their build systems write to them.
• Select GNU Patch, Bison, and Flex explicitly instead of using
  undeclared publisher tools.
• Build lsof through wasm32posix-cc, which keeps target and ABI
  flags under the Kandelo SDK's control.
• Authenticate fbdoom's Chocolate Doom source and preserve exact patch
  whitespace with a scoped .gitattributes rule.
• Accept Formula#system's normal success result while retaining
  Homebrew's bounded command log for real failures.
• Reserve fresh immutable bottle identities for the seven Formulae.
• Materialize one sealed recipe response for validation and
  installation instead of consuming the same one-shot response twice.

Current evidence

The branch is rebased on tap main at 8af204c. Generic publisher,
resource-attestation, staging, and sealed-projection support now comes
from merged tap prerequisites rather than being duplicated here. The
base also owns the credential-free homebrew-bootstrap support-data
path. This PR contains only the seven migrations and their focused
support tests.
Both fresh exact-head tap contract checks pass at a9bddb5.

The previous parallel dry run built and installed all seven programs.
Every job reached brew test, where the same missing closed Node/tsx
runtime stopped the test launcher. No bottle was uploaded or published.
That shared publisher gap is addressed by Automattic/kandelo #1134.

Local and tap validation also covers:

• 130 Formula-support tests with 2,290 assertions;
• shell syntax for every changed recipe entrypoint;
• exact recipe file sizes, SHA-256 values, and Formula manifest hashes;
• brew style for all seven Formulae;
• closed schema-3 classification and Rust preflight for all seven;
• successor bottle identities; and
• Ruby trust, Python AST, ShellCheck, and git diff --check.

Prior dry run:
https://github.com/kandelo-dev/homebrew-tap-core/actions/runs/30436084638

Next

1. Land the closed Formula-test runtime in Automattic/kandelo #1134.
2. Re-run all seven Formulae concurrently against exact Kandelo and tap
   commits.
3. If all seven builds and tests pass, mark this PR ready and merge it.
4. Publish the seven immutable bottles from tap main.
5. Exercise the resulting package generation in Node and Chromium.
6. Promote the generation and apply the existing reviewed trust-rotation
   runbook.

This PR remains a draft until step 2 supplies exact-head evidence.