gzip: enforce the final Wasm artifact contract

[brandonpayton]

Purpose

Make Gzip obey the tap's fail-closed final-artifact contract before any executable is installed or bottled.

Gzip was the remaining uncovered package in the tar/wget/zip/unzip/gzip leaf audit. Without this check, an ABI-mismatched module, legacy Asyncify artifact, or incoherent fork surface could pass through the Formula even though the shared tap policy requires those failures to stop the build.

Change

This is one commit, one Formula, and four added lines:

• declare WABT and Binaryen as build-only inspection dependencies;
• validate the final linked gzip module immediately after make and before installation;
• require fork: :forbidden, matching the exact artifact's imports and exports.

gunzip and zcat are literal symlinks to the validated gzip module, so this covers every unique installed Wasm executable. There is no Formula revision bump, bottle block, archive, sidecar, or ABI change.

Current review identity

• base: 846298574114fcdaa55421bd6d6d23975ce1027d
• head: f0e78a5b0decb92705870a9ad078ef8a9e7b9e12
• tree: e4b5d43548086d4400e244ed539ebef1350d19e9
• Formula blob: 0df84666b0d7e20d0dcf1764f4bd025c4882faeb

The rebase preserved both the stable patch ID (bbbe2f756aca0b1e2d7aba0d1e756224a45adb06) and the reviewed Formula blob. The intervening tap commits isolate guest output from host diagnostics and add ncurses final-artifact validation. Neither changes Formula/gzip.rb or the shared artifact validator.

Validation evidence

The unchanged Formula blob was previously source-built with Automattic/kandelo#936 at exact head 256cb8844a26468fbde2dd77d6f93f0828a35fc4 and pinned Homebrew revision 34c40c18ffa2029b611b61c73273e32c003d0842:

• the Formula installed, ran all compression/member/alias tests, and produced a local wasm32 bottle;
• the validator reported ABI 39 and proved kernel.kernel_fork, the continuation interface, and legacy Asyncify are absent;
• installed and bottled gunzip and zcat are symlinks to gzip;
• the strict ABI 39 build handoff was created and independently revalidated;
• the unmodified base and candidate produced byte-identical gzip modules: 204,654 bytes, SHA-256 0fd5fb58b5e64096aa13f2018472bb845aaad9764cfa1681e8af07756ad13e56.

Exact current-head checks after rebasing:

• Formula syntax passed;
• Homebrew style passed with no offenses;
• Formula support passed 48 tests / 380 assertions;
• Formula support TypeScript passed 15 / 15 tests through Kandelo's declared dev shell;
• #936 source-closure validation accepted Gzip using Homebrew's portable Ruby;
• git diff --check passed.

Merge versus publication

This Formula source change can merge now. It changes only fail-closed inspection of an already-built artifact and does not depend on the SDK facts, publisher workflows, repository trust settings, or a new bottle.

Publishing the authoritative bottle remains a later gated operation. Before publication, merge the reviewed publisher (#936), secure and merge the tap caller workflows (#22), finish the SDK facts stack (#913, #874, then tap #106 where applicable), and rebuild from the final merged heads with provenance and handoff validation. Keeping those publication gates separate avoids treating release infrastructure as a prerequisite for reviewing and merging Formula source.

[brandonpayton]

Independent devil's-advocate review: ACCEPT, no findings at exact head a02b69fb8f5d8eb7e5fcb3faa78f4fb54a798a9d / tree 693399e85f8df2a53757447d5e6241c0030ea90a.

The review independently confirmed:

• validation runs after the sole final link and before copy/chmod;
• gunzip and zcat are symlinks to the one validated Wasm module;
• the exact artifact is ABI 39, fork-free, continuation-free, and Asyncify-free, so fork: :forbidden is correct;
• WABT/Binaryen are build-only and the runtime closure is empty;
• base and candidate installed gzip bytes are identical (0fd5fb58b5e64096aa13f2018472bb845aaad9764cfa1681e8af07756ad13e56), so no revision bump is correct;
• the exact bottle/handoff binds tap a02b69f, Kandelo 256cb884, zero dependencies, and bottle SHA-256 f179602ead611a9eb00141b3058408df9e86cdf702cffb43e48de1feea163ead;
• syntax, style, diff, source closure, Formula tests, and handoff validation passed;
• current formulae: use SDK-owned cross-compilation settings #106 overlap merges cleanly, with an exact rebase and rerun still required after the SDK gates land.

[brandonpayton]

Independent exact-head devil review at f0e78a5b0decb92705870a9ad078ef8a9e7b9e12: ACCEPT the source merge; no code findings. gzip is the only unique installed Wasm module; gunzip and zcat remain literal symlinks to it. The guard runs after the final link and before the byte-preserving install, fork: :forbidden matches the verified artifact, and WABT/Binaryen exactly own the inspection tools. A revision and ABI bump are correctly omitted because this validation-only change does not alter installed bytes. The source merge is independent of SDK/publisher/bottle gates. Rebase onto tap main 846298574114fcdaa55421bd6d6d23975ce1027d preserved Formula blob 0df84666b0d7e20d0dcf1764f4bd025c4882faeb and stable patch ID bbbe2f756aca0b1e2d7aba0d1e756224a45adb06. Exact-head syntax, style, Ruby support (48/380), TypeScript support (15/15), source closure, and diff checks passed.