make: add GNU build automation for Kandelo

[brandonpayton]

Summary

• add GNU Make 4.4.1 as an idiomatic Kandelo Homebrew formula
• depend on the tap Dash formula for real POSIX recipe execution
• replace the registry build workaround that defined MK_OS_ZOS with a focused WebAssembly patch selecting the two-argument main and real environ path only
• enable the upstream posix_spawn implementation using the package-specific synchronous-error runtime fact; the finished binary does not import kernel.kernel_fork and is intentionally not fork-instrumented
• enable GNU Make's loadable-object API instead of disabling it: install gnumake.h, mark only the documented gmk_* API as public under Wasm, and test a compiled side module that registers and invokes a custom Make function
• use upstream make install, preserving the public header plus man/info documentation in the keg

Root cause and platform contracts

The original formula disabled loadable objects based on the incorrect assumption that Kandelo lacked dlopen. Kandelo supports Wasm side modules, but two platform details were missing:

1. musl's weak dlfcn stubs made AC_SEARCH_LIBS(dlopen) report none required, so Make omitted -ldl and the SDK did not select its functional libc/glue/dlopen.c implementation; sdk: centralize cross-compile function availability kandelo#874 makes the -ldl requirement authoritative;
2. GNU Make opens the executable's global symbol table with dlopen(NULL, ...); dlopen: expose the main program symbol scope kandelo#879 implements that main-program handle and RTLD_DEFAULT lookup in the shared Node/browser host path.

The SDK intentionally does not make arbitrary executable symbols public. The formula's focused gnumake.h patch gives default visibility to GNU Make's five documented plugin entry points while leaving internal symbols hidden.

Validation

Built from the formula source through Homebrew against ABI 18 with the pending platform stack from Automattic/kandelo#867, #874, and #879.

• brew test automattic/kandelo-make-review/make --verbose
  • GNU Make 4.4.1 version
  • compile and load a real Wasm side module against installed gnumake.h
  • register and invoke a gmk_add_function callback returning allocated data
  • two parallel prerequisites
  • exact staged Dash dependency
  • recursive execution of the exact staged Make binary
  • generated output files and incremental no-op behavior
  • missing command returns Make status 2 with ENOENT
• exact Cellar Make, Dash, and compiled plugin bytes under Chromium BrowserKernel
  • side module loads and its custom function returns plugin=Kandelo
  • parallel and recursive recipes exit 0 with the expected output and empty stderr
• artifact guards
  • ABI 18
  • WebAssembly binary with the five gmk_* exports
  • functional dlopen glue present; weak "Dynamic loading not supported" stub absent
  • no legacy Asyncify, no kernel.kernel_fork, and no wpk_fork_* exports
• source patch application and source build through Homebrew
• strict Homebrew audit, style, Ruby syntax, and git diff --check

The normal browser nonzero-exit diagnostic path remains gated on Automattic/kandelo#875 so a failed recipe does not receive browser-only host text on guest stderr.

Source merge and bottle gates

The source formula may merge independently after review; it contains no bottle block or sidecar. Bottle construction, publication, and the installability claim remain gated on:

• Dash dash: add the instrumented POSIX shell #14 is merged into tap main, so the declared source dependency is resolved
• sdk: reserve an 8 MiB main-thread shadow stack for linked programs kandelo#842 for the shared 8 MiB main-thread stack floor
• sdk: centralize cross-compile function availability kandelo#874 for the authoritative -ldl configure fact
• dlopen: expose the main program symbol scope kandelo#879 for dlopen(NULL) and RTLD_DEFAULT
• Test that browser nonzero exits do not alter guest stderr kandelo#875 for Node/browser stderr parity on nonzero recipe exits
• ci: isolate and verify Homebrew bottle publication kandelo#881, #882, #885, and #890 for caller-scoped, cache-isolated tap-native publication and same-tap dependency trust
• the final Dash bottle first, after Dash clears its direct #873 and #888 prerequisites; ci: add thin tap workflows for bottle publishing and maintenance #22 is used only if a branch-based pre-merge bottle dry run is needed
• trusted ABI 18 bottle build/publication from final head d338c75953b8181b62793f1822ebb1012c0101b2, after the Dash bottle is final

The pthread fork-continuation fix and ABI 18 transition from #867 are merged.

Source review is complete and the source formula may merge now. The dependency and platform gates above still block bottle publication and any stock-guest installability claim.

Current-main restack

Replayed the two Make-owned commits from the old Dash branch onto tap main ab96df6e97181338bb01e5aa767f7cf09b0c9460, which contains squash-merged Dash #14. The only conflict was the additive package catalog; the resolved README retains every current main entry and adds only Make.

Every artifact-producing formula line after the support import is byte-identical to the previously validated bc4d6bd head (tail SHA-256 579aad2e9b56e179e56bad655b4e34301a5f621dbe6208826be1f5c69815cd0d). The loadable-object follow-up retains stable patch ID 6eb44606f6ecc6d0125df66d0b8797d15bb77ac2; the separate final commit changes only formula support loading to the installed Tap.fetch path.

Current head: d338c75953b8181b62793f1822ebb1012c0101b2. Through scripts/dev-shell.sh, Homebrew Ruby syntax, literal formula loading, brew style, the support suite (21 runs/186 assertions), git diff --check, and current-main merge assertions passed. The main-relative diff contains only Formula/make.rb and the Make README entry, and the worktree is clean. No source build, runtime result, or bottle is newly claimed by this restack.

Independent review

Devil review completed. It found and corrected four material issues in the original revision: a false dynamic-loading boundary, missing standard installation outputs, hidden gmk_* exports, and whitespace-invalid embedded patch context. No formula-local blocker remains after commit cb2775f; the listed platform/dependency gates remain external blockers.