locale: provide complete POSIX locale inspection

[brandonpayton]

Why

Make POSIX locale inspection a first-class Kandelo Homebrew package backed by the real musl locale state. This replaces incomplete enumeration/output behavior with a source-built utility that reports what Kandelo libc can actually load.

Locale tools tell programs and users which language and formatting data the C library can actually load. Incomplete or synthetic enumeration makes software choose locales that are unavailable at runtime, so this Formula must report musl’s real locale state and preserve values safely for shell reuse.

What changed

• report the complete POSIX LC_TIME, LC_NUMERIC, LC_MONETARY, LC_CTYPE, LC_COLLATE, and LC_MESSAGES keyword surface
• enumerate every colon-separated MUSL_LOCPATH component deterministically
• mirror musl's 23-byte locale-name and 256-byte path-buffer admissibility rules
• follow valid regular-file symlinks while excluding directories, FIFOs, empty files, broken links, invalid names, and loader-skipped paths
• sort and deduplicate locale names across components
• emit shell-reenterable assignments that preserve spaces, metacharacters, quotes, backslashes, and embedded newlines
• correct the Formula license to LGPL-3.0-only, matching the compiled sources
• validate actual catalog selection rather than merely listing arbitrary files

Platform And Publication Gates

Do not merge or publish this Formula yet.

1. Batch PHP support and bundle ABI updates with their runtime changes kandelo#907 must land and durably publish the ABI 39 package baseline.
2. libc: report complete locale information kandelo#916 must land the required complete libc locale-name surface.
3. Rebuild and retest from that merged platform before generating bottle metadata.
4. Publish/pour through the trusted Homebrew publisher and run stock-guest Node and Chromium verification.

No bottle metadata is included.

Exact Provenance

• tap head: 522a66ac8074c775400e710666b3b041564d6786
• tap tree: 5842fd525a7facbfc315028855ec20bde5d6dc61
• validation platform: locked #907 plus exact #916 integration 0a4579d23
• source SHA-256: 877c247f0d2765379efd71174a10cef787597ab5d8e4e7fe939ccb65c0abe9aa
• final executable: 64,309 bytes, SHA-256 5ae034fb3b69f4eda4d6c264a0bc943edffd82c1e99b4cb820dfe5c8a169be89

Validation

• two clean Formula builds were byte-identical
• independent Homebrew source reinstall reproduced the exact executable size and SHA
• full brew test passed in Node and Chromium on both author runs and on independent review
• real catalog selection, 23/24-byte name boundary, 248/249-byte path boundary, sorting/deduplication, valid/broken symlinks, nonregular files, empty components, and hostile shell-byte round trips passed
• artifact guards confirmed ABI 39, fork-forbidden, no legacy Asyncify, and no host/build path leaks
• brew audit --strict, brew style, Ruby syntax, wasm-validate, and git diff --check passed
• fresh independent exact-head review accepted with no blocker, high, or medium findings

Residual Boundaries

The utility duplicates musl-private name/path constants and must track future musl changes. Enumeration uses stat rather than loader-identical open/fstat/mmap, so unreadable or concurrently replaced regular files can be transiently listed. Browser symlink-specific coverage remains indirect because immutable browser guest-file staging cannot represent symlink identity.