zstd: add threaded compression library and tools

[brandonpayton]

Purpose

Replace the registry-only zstd program with a source-built Homebrew dependency root that exposes both the compression CLI and a complete static-library consumer contract.

Changes

• build zstd 1.5.7 from verified upstream source with Kandelo pthread support;
• install the multithreaded static library, public headers, stable-opt pkg-config metadata, the zstd CLI aliases, and the zstd manpage;
• disable undeclared zlib, xz, and lz4 format integrations;
• omit the optional zstdgrep and zstdless shell helpers because they would invert the dependency wave by requiring the leaf grep and less packages;
• compile the library test through the installed pkg-config interface;
• exercise threaded CLI compression and a two-worker, multi-job target-linked libzstd round trip.

Evidence

Using a dedicated Homebrew prefix and ABI-18 Kandelo integration runtime:

• final-head source reinstall completed and produced a 19-file, 2.0 MB keg;
• literal brew test automattic/kandelo-homebrew/zstd passed under Node;
• the CLI test compresses and decodes about 2 MiB with -T2 and validates the unzstd/zstdcat aliases;
• the C consumer resolves the stable opt prefix through libzstd.pc, verifies -lzstd and -pthread, and round-trips 2 MiB as multiple 1 MiB jobs with two workers;
• the exact final C consumer and installed CLI passed in Chromium with empty stderr;
• ruby -c, brew style, brew audit --strict --online, and git diff --check passed;
• the plain-HTTP source mirror was fetched with HTTPS disabled and matched the declared checksum;
• the installed zstd Wasm reports ABI 18, imports pthread support, and has no fork or Asyncify instrumentation.

An independent devil's-advocate pass found and corrected the undeclared helper-script dependencies and the prior test's manual -I/-L bypass of the published pkg-config contract. No formula-code blocker remains. The artifact-producing commits were rebased semantic-preservingly onto tap main at a4c52a1; commit 95250d1 changes only shared-support loading to the installed Tap.fetch path.

Source merge and bottle gates

The source formula may merge independently after a fresh formula review; it contains no bottle block or sidecar. Bottle construction, publication, and any installability claim remain gated until:

• sdk: reserve an 8 MiB main-thread shadow stack for linked programs kandelo#842 has landed;
• Marshal sched_getaffinity masks across process memory kandelo#884 has landed so CPU discovery uses correctly marshalled process memory;
• ci: isolate and verify Homebrew bottle publication kandelo#881 has landed so publication is independent of Actions caches;
• Reject stale Wasm artifacts with aliased ABI exports kandelo#882 has landed so bottle materialization rejects aliased stale-ABI exports;
• homebrew: publish tap-native formulas without registry duplicates kandelo#885 has landed so tap-native formulae publish without registry duplicates;
• trusted bottles are built from 95250d1 and pass sidecar generation, stock guest pour, CLI tests, and a poured-bottle library consumer;
• ci: add thin tap workflows for bottle publishing and maintenance #22 has passed its branch-aware bottle dry run;
• the final tap CI/check set is green.

The pthread fork-continuation fix and ABI 18 transition from #867 are merged.

Post-rebase validation through scripts/dev-shell.sh: Homebrew Ruby syntax passed, the current support suite passed 21 runs/186 assertions, brew style reported no offenses, and git diff --check passed. At 95250d1, syntax, style, literal loading through Tap.fetch, the support suite (21 runs/186 assertions), and git diff --check passed. Functional source-build evidence remains tied to unchanged artifact logic; no bottle is claimed.

This wave intentionally publishes wasm32 only. Firefox, WebKit, and wasm64 were not validated and are not claimed here. No Kandelo ABI or main-repository files change in this PR.

[brandonpayton]

Devil's-advocate review on final head c3bb768 is complete.

Two blockers were corrected:

1. The installed zstdgrep and zstdless scripts invoked undeclared grep/less leaf packages. The dependency-root wave now omits those optional helpers instead of publishing commands that fail outside a preloaded demo image.
2. The library smoke test manually supplied include/library flags and therefore did not validate the installed libzstd.pc contract. It now resolves the stable opt prefix and all static link flags through pkgconf.

I also enlarged both threaded workloads. The C path now uses two workers across multiple 1 MiB jobs, rather than merely accepting ZSTD_c_nbWorkers for a tiny input. Final source reinstall, literal Node brew test, strict online audit/style/syntax, and an exact Chromium run all pass.

No formula-code blocker remains. This is not merge approval until #842, #867/ABI-18 artifacts, #884, and trusted final-head bottle pour/test gates are real.