sharutils: add shell archives and uuencoding

[brandonpayton]

Why

Add GNU Sharutils as first-class Kandelo Homebrew programs: shar, unshar, uuencode, and uudecode.

This PR is stacked dependency-first on Coreutils PR #16 because generated shell archives execute the real target utilities they declare rather than relying on a demo wrapper or ambient rootfs commands.

Sharutils-generated archives execute shell, checksum, text, and compression programs when a user unpacks them. The package therefore cannot be reviewed as an isolated executable: it must declare those Homebrew dependencies and prove that generated archives use the actual Kandelo commands rather than wrappers or ambient image contents.

What changed

• Build the exact GNU Sharutils source through Kandelo's SDK, sysroot, configure wrapper, and shared artifact validator.
• Declare bzip2, Coreutils, Dash, Grep, gzip, Sed, and xz as the complete runtime closure.
• Generate archives using stable guest shell, checksum, filesystem, text, and compressor paths.
• Fork-instrument shar, whose archive workflows execute child programs.
• Require unshar, uuencode, and uudecode to remain fork-free.
• Reject ABI mismatch, incomplete continuation state, retired Asyncify, and host/build paths.
• Support plain, bzip2, gzip, and xz archive extraction.
• Deliberately exclude obsolete compress output and assert it is unavailable instead of silently substituting another format.

The PR contains no bottle block, archive, sidecar, receipt, provenance metadata, generated Wasm, main-repository change, or ABI change.

Current review

The single Sharutils commit was restacked onto the compacted Coreutils head b1afa1688387abd692698358970357469da110ac.

• Exact head: 27cb01084baf0193c1980bd8485c611538936391
• Formula SHA-256: 467af85f4a2a62724b328424b35e50bf1e8ec1d84457932aabd92e63109a16bd
• Upstream archive SHA-256: 2b05cff7de5d7b646dc1669bc36c35fdac02ac6ae4b6c19cb3340d87ec553a9a
• The Formula blob is byte-identical to the prior reviewed head.
• Ruby syntax and git diff --check passed.
• The #936 static source-closure validator accepted the exact head.
• Direct runtime closure is exactly bzip2, Coreutils, Dash, Grep, gzip, Sed, and xz.

Prior exact-Formula source installation and literal brew test --verbose evidence covered binary and base64 encode/decode round trips plus plain, bzip2, gzip, and xz shell-archive extraction through the declared target dependencies. The receipt identified a source install, not a bottle pour. No source build, browser execution, bottle, or published pour was rerun for this history-only restack.

Ordering and gates

This PR must follow tap Coreutils PR #16. Coreutils currently waits for Automattic/kandelo#874, #883, and #936 plus exact current source validation. After #16 merges, restack Sharutils directly onto current tap main, rerun its exact source build and complete Formula test, then perform a final devil's-advocate review before source merge.

Bottle publication additionally requires:

• #936 and tap PR ci: add thin tap workflows for bottle publishing and maintenance #22 with the repository security boundary active;
• provenance-verified current bottles for all seven declared runtime dependencies;
• a trusted exact-merged-head Sharutils build;
• reviewed provenance and stock Node/Chromium pours of the published bytes.

The earlier #873/#882/#887/#889/#903 and ABI-batch references are obsolete or consolidated. Merged #907 supplies the supported fork-instrumenter build path, #936 owns the publisher and artifact-validation contracts, and the active platform ABI is 39.

[brandonpayton]

Independent exact-head devil's-advocate review: ACCEPT at d050367c97d81468afdd5b83a1d48c9649dbade4, stacked on Coreutils e8c3f61bdcfd1e0ae2dd9c98a33d6f803afcfc07.

The reviewer verified the declared runtime closure, fork policy for all four binaries, host-path guards, obsolete-compress exclusion, patch/formula identity across the restack, and the full literal test through current #104 exact-keg resolution. Syntax, style, strict online audit, and diff checks pass. Merge remains held on PR #16 and its main-platform gates; bottle publication remains held on deterministic instrumentation and the consolidated ABI.