util-linux: add priority and IPC command tools

[brandonpayton]

Why

Kandelo needs real command-line tools for calendar display, process-priority changes, and System V interprocess communication (IPC) cleanup. The legacy package set does not make this util-linux surface available as one reviewed Homebrew Formula, and pretending unsupported inspection commands work would hide kernel gaps.

This Formula deliberately includes only commands Kandelo can validate truthfully today. ipcs, which lists IPC objects, and logger, which sends messages to a system log service, remain excluded until Kandelo exposes the required live kernel and networking state.

What changed

• build upstream util-linux 2.42.2 through the Kandelo SDK and install cal, ipcrm, and renice
• validate every installed executable as ABI-current, fork-free Wasm
• exercise calendar, priority, permission, and SysV IPC removal behavior through Kandelo
• document the intentionally omitted commands: ipcs needs truthful SysV IPC enumeration, and logger needs cross-process AF_UNIX or loopback UDP delivery

Platform gates

Do not merge this source Formula until both platform fixes have landed:

• Preserve SysV semaphore errno across host dispatch kandelo#912 preserves the exact semctl errno needed to verify semaphore removal
• Reject stale Wasm artifacts with aliased ABI exports kandelo#882 rejects stale Wasm artifacts with aliased ABI exports

Do not publish util-linux until the final ABI and trusted publisher produce and validate its canonical bottle. No bottle metadata is hand-written in this PR.

Validation

Canonical source build and Formula test were run with:

• Kandelo ABI 39 batch 0f464442d
• stacked semctl fix f7f3042bf
• Clang/LLD 21.1.7
• declared Homebrew Binaryen 130
• ./scripts/dev-shell.sh /tmp/kandelo-util-linux-canonical-test.sh
• literal brew install --build-bottle --formula automattic/kandelo-homebrew/util-linux
• literal brew test automattic/kandelo-homebrew/util-linux

The canonical install/test passed and reproduced these artifacts exactly:

Program	SHA-256	Bytes
cal	65618e5fde6aab1acdcc1e8a56c46e8805bc42e191d698046cce755159863551	135202
ipcrm	0fda39086482e41fd7bece0d41f0fbc8b6ccd87d621b9d049eb08e16526f2a2b	95658
renice	4feea1836ec208ed7f6af0c1a0137a06dbc1b2b7d572f4a122149f7a29132166	56527

Binaryen causality was isolated with byte-identical objects and archives: the dev shell's Binaryen 126 leaves two musl mallocng invalid branches as br, while the declared Homebrew Binaryen 130 folds them to unreachable. Replaying the link with Binaryen 130 reproduced all three canonical hashes, so this is a tool-version difference rather than build nondeterminism.

Formula coverage includes:

• Node and Chromium version execution for all three installed programs
• functional cal and renice execution in Node and Chromium
• direct priority-state verification in Node and Chromium
• non-root installed renice exec with exact EPERM
• Node fork+exec of installed ipcrm, removing message queue, shared memory, and semaphore objects with exact EINVAL afterward
• ABI, legacy Asyncify, fork-surface, and embedded-path guards
• Ruby syntax, whitespace, and 120-column static checks

The ipcrm fork+exec Formula case is Node-only because the current browser Formula helper cannot stage exec_programs. A final poured-bottle browser integration remains required before publication; the browser claims in this PR are limited to the explicit Chromium cases above.

[brandonpayton]

Independent devil's-advocate review: ACCEPT exact head a253d0e1b68d8bc1112940e7e85086752b594a34, tree cac3e94f3801f11b0bd3e6aac35d6bd3a7a7798f.

The review verified official util-linux 2.42.2 provenance/license metadata, the exact three-program and manpage surface, fail-closed ABI/fork/path validation, and the absence of hidden target dependencies. The Formula uses real upstream cal, ipcrm, and renice; it does not synthesize ipcs enumeration or logger delivery.

Canonical Homebrew source install/test passed on ABI39 plus #912 with declared Binaryen 130. The v126/v130 byte difference was independently pinned to Binaryen trap folding after byte-identical Clang/LLD inputs, and v130 reproduced the canonical hashes. Node and Chromium cover the stated calendar/priority paths; Node covers installed ipcrm fork+exec and exact post-removal EINVAL. The browser ipcrm exec limitation is explicitly unclaimed.

Source merge remains gated on main #912 and #882; final bottles/pours remain separate ABI/publisher gates. Do not merge before those prerequisites.

[brandonpayton]

ABI 39 follow-up on the intentionally omitted logger command (no change to this PR head):

The cross-process routing gate is still real, and there is a second independent syscall-semantic gate. In one NodeKernelHost, an ABI 39 UDP server (pid 100, 0.0.0.0:24123) remained blocked while a separate guest client (pid 101, 127.0.0.1:24123) retried 25 times and timed out. The kernel binding registry is global, but udp_send_datagram explicitly skips endpoints whose owner PID differs; AF_UNIX datagrams are likewise process-local.

Additionally, util-linux 2.42.2 logger always calls sendmsg with header and message in 2+ iovecs. ABI 39 copies all guest iovecs into kernel scratch, but kernel_sendmsg parses only iov[0]. A focused guest fixture sent {HEADER:, BODY} and received exactly sent=7 received=7 payload=HEADER: instead of 11 / HEADER:BODY.

Open main PR #855 overlaps only loopback UDP and needs redesign/rebase; it does not address AF_UNIX or multi-iovec sendmsg. logger therefore remains correctly omitted until routing and aggregate-iovec semantics are fixed and validated in two guest processes. A stderr-only Formula would hide these platform gaps.