[Homebrew] Keep the sealed Formula checker across Homebrew re-exec

[brandonpayton]

Why

Homebrew removes ordinary environment variables before it runs a Formula's
tests. That removed WASM_POSIX_XTASK_BIN, even though the trusted publisher
had selected an exact checker for Kandelo's transitional source-build
attestation. The Formula then fell back to the developer shell, which is not
available inside the isolated publisher and caused the Asa bottle test to fail.

What changes

• Accept the checker only through the Homebrew-preserved
  HOMEBREW_KANDELO_XTASK_BIN bridge created by
  Automattic/kandelo#1082.
• Capture and validate the checker before Formula code runs. It must be a
  canonical, root-owned, read-only, single-link file at the publisher's exact
  target/<host>/release/xtask location under the trusted Kandelo checkout, and
  its opened file must still match the inspected file.
• Freeze the validated path and pass it explicitly as WASM_POSIX_XTASK_BIN to
  all Kandelo Node and browser test runners. Formula environment settings cannot
  replace it.
• Keep ordinary consumer installs unchanged when the publisher bridge is absent.
• Pin all live publish, dry-run, maintenance, and rollout trust references to
  the reviewed publisher commit
  ec586b9b3c22034bbbbbac13631e2c4badcb9898.

The tests cover all eight runner paths, a real child process, post-load
environment changes, Formula-supplied overrides, and rejection of missing,
writable, empty, misplaced, invalid-host, out-of-root, symlinked, hard-linked,
and non-root-owned checkers.

Validation

• brew ruby Kandelo/formula_support/test/kandelo_formula_support_test.rb
  — 102 runs, 1,658 assertions, no failures or errors
• brew ruby Kandelo/test-workflow-trust.rb — passed
• PYTHONDONTWRITEBYTECODE=1 python3 -m unittest scripts/test_abi42_rollout.py
  — 41 tests passed
• actionlint — passed
• git diff --check — passed
• exact live-pin audit — seven expected references and no stale live publisher
  reference

A live bottle publication is intentionally not part of this PR's local
validation. The publisher's full suite and independent security review are
green; its privileged Ubuntu preflight remains the rollout gate.