icu: add the Unicode dependency root

[brandonpayton]

Purpose

Move ICU 74.2 from Kandelo's package registry into the first-party Homebrew tap as a normal source-built dependency Formula.

The keg supplies the static Unicode and globalization libraries, headers, pkg-config metadata, and runtime data needed by PHP's intl extension and future language runtimes.

Formula contract

• Build the pinned upstream source with Kandelo's wasm32 SDK; no registry build-script bridge is used.
• Consume the exact automattic/kandelo-homebrew/libcxx keg as the only target runtime dependency.
• Build ICU's native data generators in Kandelo's declared host dev shell, isolated from target libcxx.
• Cross-build static PIC target libraries and install the complete Unicode header set.
• Publish both ICU's conventional versioned data path and the flat share/icu.dat path used by Kandelo's PHP consumer.
• Install relocatable icu-uc, icu-i18n, and icu-io pkg-config metadata.
• Omit target generator launchers and metadata because target tools are deliberately disabled.
• Fail closed on archive members, data size and digest, metadata shape, header count, and producer-path leakage.

This source PR contains no bottle, receipt, sidecar, workflow, or Kandelo ABI change.

Exact-head review and validation

Independent review used source head c3238b8aac56b1826fabbd8a6611d0c0de924046 with tree b018ed675d135f84dc6baf77527161faf50833e1. The Formula was source-built against its exact tap libcxx dependency on clean Kandelo main 74689b98588e3cf8bbb3d82d4b83999775a74498 at ABI 39. That platform revision includes Automattic/kandelo#913, so the prior SDK linker-order gate is resolved.

The exact installed receipt records the reviewed tap head and confirms a source build rather than a bottle pour. Validation covered:

• a static C++ consumer linked against all four ICU archives and tap libcxx;
• locale display names, Unicode formatting, Swedish collation, and NFC normalization;
• both the conventional versioned data archive and explicit flat share/icu.dat path in Node;
• both data layouts in Chromium through the Formula's exact browser runner, each producing icu-ok:French:42:sv-SE:NFC;
• archive member counts 1 / 243 / 12 / 201, 197 headers, and both 30,782,896-byte data files with SHA-256 dc778b9ffe18ed319ad3fb70754f80e51cf7b6dbfff38fc0c0a5f27bb5463dad;
• relocatable pkg-config files and no leaked builder, Homebrew Cellar, private temporary, or Nix store paths;
• Ruby syntax, Homebrew style, strict online audit, and git diff --check;
• Formula support tests: 45 Ruby tests with 340 assertions and 13 TypeScript tests.

The Homebrew test command completed compilation, artifact validation, and both Node scenarios. Its Chromium child was rerun directly with the same generated Wasm, guest-file manifests, exact tap runner, and clean ABI 39 platform artifacts because this disposable audit prefix was placed under a shared worktree and Homebrew's macOS sandbox rejected Vite's cache directory before Kandelo started. Both direct Chromium scenarios passed.

The dependency closure is exactly ICU plus same-tap libcxx. A merge-tree check against current tap main is conflict-free; the intervening shared helper change affects only callers requesting merge_stderr, which ICU does not.

Bottle publication

Bottle publication is deliberately separate from this source merge. Do not publish an ICU bottle until the trusted publisher path and tap security boundary from Automattic/kandelo#936 and tap PR #22 are available, a current provenance-verified libcxx bottle exists, and a trusted exact-merged-head ICU build passes full Node and Chromium pour validation.

[brandonpayton]

Independent exact-head devil review: ACCEPT for source review at 5f2f4d24c536d72f20d5a76976ed571e66133a30 / tree dbe46426d06a9ba58ee40e47d37c42faa984d480.

The review checked source provenance, native-generator isolation, exact tap-libcxx closure, PIC target archives, fail-closed relocatable pkg-config metadata, truthful removal of unavailable target tools, ABI 39/fork-forbidden validation, and both ICU data paths. Two retained clean builds reproduce all four archives and both data files byte-for-byte. Conventional u_init() lookup and explicit udata_setCommonData() loading each pass with only their own guest data layout on both Node and Chromium. Retained archives contain no builder, Cellar, or Nix paths.

brew style, Ruby syntax, and diff checks pass. The independent reviewer did not rerun the two full builds or path-based strict audit; implementation evidence already covered the builds, and current Homebrew requires strict audit by installed Formula name. No Formula blocker remains. #882 and the final ABI/publisher/poured-consumer gates in the PR body remain external; no bottle is being published from these local bytes.