homebrew: require prior bottles for consumer dependencies

[brandonpayton]

Purpose

Make dependency-first Homebrew publication an enforced build invariant. At the pinned Homebrew commit (34c40c18ffa2029b611b61c73273e32c003d0842), brew install --build-bottle applies the source-build request to the selected Formula, but dependency installers are constructed with force_bottle: false. A missing dependency bottle can therefore fall back to a source build and make a consumer bottle appear independent of the previously published Kandelo bottle.

Stack

This is one focused commit on top of #885 at exact parent d2696657d0a75a66c1b6bacbf7e346a2769f27a2. It should merge only after the existing Homebrew publisher stack. The inherited Vitest teardown failure is already isolated by #889 and is unrelated to these package-publishing changes.

Changes

• Resolve the selected Formula's recursive runtime closure and install each same-tap dependency explicitly with --force-bottle --as-dependency --ignore-dependencies before starting the consumer source build.
• Require exact equality between that resolved same-tap closure and the target INSTALL_RECEIPT.json closure.
• Capture a strict, bounded provenance document for every dependency: bottle-pour receipt flags, exact tap commit, Formula SHA-256, selected Kandelo bottle tag/digest/URL/cellar/rebuild, and digest-bound fetch/pour log evidence.
• Advance the credential-free build handoff to schema 2 with exactly four files, binding dependency-provenance.json by SHA-256 and byte count.
• Revalidate provenance against the fresh exact tap in verifier and finalizer jobs before publication.
• Add adversarial coverage for missing bottles, source-built receipts, missing closure entries, Formula drift, manifest-vs-bottle log filtering, tampering, and size bounds; document the dependency-first contract.

No ABI, kernel/runtime behavior, Formula, bottle, or package artifact changes are included.

Validation

• ./scripts/dev-shell.sh bash scripts/test-homebrew-publish-workflow.sh
• ./scripts/dev-shell.sh bash scripts/test-homebrew-tap-native-sidecars.sh
• Dev-shell Bash syntax checks for all touched shell scripts
• Dev-shell Python compile and CLI parser check
• ruby scripts/check-homebrew-publish-workflow-trust.rb
• Dev-shell Ruby YAML parse of the reusable publisher
• git diff --check

actionlint is not present in the declared dev shell, so I did not use the host installation; hosted preflight remains the actionlint evidence.

[brandonpayton]

Exact-head CI classification for 655e62f691ef76b877332f51c4082ddb738262e3:

test-gate-prepare failed during binary materialization before any platform suite launched. This is a stacked-base staging selection issue, not a dependency-provenance test failure:

• homebrew: require prior bottles for consumer dependencies #900 is based on homebrew: publish tap-native formulas without registry duplicates #885.
• homebrew: publish tap-native formulas without registry duplicates #885's exact staging release pr-885-staging contains the package keys computed by homebrew: require prior bottles for consumer dependencies #900 (for example Bash 28a7bea0, Bzip2 78f873f3, Coreutils 198092d9, Curl db51ebb0).
• Because homebrew: require prior bottles for consumer dependencies #900 itself does not touch package build inputs, change-scope skipped a new package matrix. The prepare job nevertheless selected durable binaries-abi-v18, whose older keys differ, so fetch-only materialization truthfully rejected all 69 stale archives.

Base staging evidence: https://github.com/Automattic/kandelo/releases/tag/pr-885-staging
Failing job: https://github.com/Automattic/kandelo/actions/runs/29196825942/job/86661632023

The exact publication/provenance gates were rerun locally after the final hardening and pass. I am not rerunning or bypassing this required CI gate; it becomes meaningful after the #881 → #887 → #890 → #885 base stack lands and its package keys are durable (or if CI gains explicit stacked-base staging selection). No broad green claim is made.

[brandonpayton]

Superseded by #936. An independent semantic comparison confirmed that #936 preserves the same-tap dependency closure and bounded dependency-pour provenance from this PR, retains every regression assertion, and strengthens the handoff with exact direct-dependency and refreshed-tap revalidation.