Why

Kandelo needs one trustworthy path from a reviewed Homebrew tap to a complete virtual filesystem image.

The bottle publisher previously treated the GitHub repository name and Homebrew tap name as the same identity. That breaks conventional third-party taps such as repository Example/homebrew-tools, whose Homebrew name is example/tools. Formula builds also run as a restricted Linux user that cannot safely traverse the original GitHub checkout path.

Separately, the VFS builder could pour bottles only into an empty filesystem and accepted package roots only as command-line flags. It could not compose an ABI-matched platform base with a checked-in, reproducible Brewfile selection.

This PR combines the reviewed publisher and VFS work so the trust boundary is tested as one system before merge.

What changed

This ordinary integration PR preserves five purpose commits:

1. Separate repository authority from canonical Homebrew tap identity for first-party and third-party taps.
2. Give the restricted Formula user root-owned, read-only aliases to the reviewed Kandelo and tap sources while keeping original checkouts, credentials, and output hidden.
3. Compose verified bottles onto an explicit ABI-matched VFS base image.
4. Parse a safe static Brewfile subset without executing Ruby, then resolve a bounded dependency closure in deterministic order.
5. Enforce the same repository-to-tap mapping in the VFS planner, including protection against a third-party repository claiming automattic/kandelo-homebrew.

The first two commits preserve #957. The next two preserve #959. The fifth fixes the cross-commit identity gap found during integration review.

This changes no Kandelo ABI and publishes no package, bottle, release artifact, or VFS image by itself. It adds no batch manifests, receipts, or batch-management framework.

Validation

Run through scripts/dev-shell.sh on exact head 97c1ca6eebd07bcac696db12095dd78590870c34 / tree 5e6d6a6495fd4a77ca19474c585c853ce8417515:

• all four rebased source commits retain the stable patch identity of their reviewed source commits;
• tap identity, publisher trust seal, patched launcher, and publisher workflow contract tests passed;
• the full package publication flow contract passed;
• static Brewfile parser tests passed;
• native sidecar, dependency closure, base-image, and third-party tap integration tests passed for wasm32 and wasm64;
• 78 focused VFS planner, builder, and image tests passed;
• host TypeScript declarations and ESM, CommonJS, and browser bundles built successfully;
• ABI snapshot validation and git diff --check passed.
• Exact-head staging run 29459527265 passed with 19 successful jobs, three expected skips, all six required composite images, cargo/kernel, fork instrumentation, full Vitest, browser, libc, POSIX, Sortix, and the aggregate test gate.
• Exact-head browser smoke run 29459527311 passed.

Independent adversarial review rejected the first integration head for a protected tap-identity gap. The focused fifth commit fixes that issue, and re-review approved this exact head with no findings.

Remaining evidence

The local host is macOS, so the exact combined Linux systemd isolation fixture remains a hosted-CI gate. An earlier version of the source-alias implementation passed its privileged Ubuntu fixture, but that is not exact-head evidence.

A real Node and Chromium boot of a public dependency-bearing Brewfile image remains the next acceptance rung. The tap currently publishes only dependency-free hello, so this PR does not claim that runtime proof. The checked-in builder and planner are Node-side tooling; the VFS bytes they produce are host-neutral.

Merge and cleanup

Validate this PR now, but merge it after #934, #939, and #945. Rebase-merge it without squashing the five purpose commits. After it lands, close #957 and #959 as absorbed and delete their exact source branches manually.