netcat: add virtual TCP and UDP workflows

[brandonpayton]

Why

Kandelo users need a standard command-line tool for inspecting and moving data
over TCP and UDP, and Kandelo needs package-level evidence that two virtual
machines can communicate through its network stack. Netcat is not yet available
as an independent Homebrew package. Adding GNU Netcat 0.7.1 matters because its
real listen, accept, stream, bind, and datagram workflows test the platform
without a package-specific network shortcut.

What changed

• Build the upstream source through the normal Kandelo SDK path and install netcat, nc, and the manual.
• Consume target-wide configure facts from the SDK while keeping only package-specific resolver choices in the Formula.
• Validate the final artifact as fork: :forbidden: Netcat command mode replaces the process with execl and does not fork.
• Declare Binaryen/WABT because the fail-closed ABI/import/export validator uses them in Homebrew's isolated environment.
• Keep reproducible prefix maps so checkout/build paths do not enter the Wasm artifact.

The scoped source patches preserve explicit boundaries:

• Mark upstream's normally completed listen loop as success.
• Avoid non-POSIX SIOCGIFCONF fallback enumeration while retaining ordinary INADDR_ANY UDP bind.
• Keep the portable path because Kandelo exposes Linux IP_PKTINFO constants but the virtual backend does not implement that sockopt/ancillary data.

Runtime contract

The tap runner creates two isolated Kandelo machines on one LocalVirtualNetwork. It starts the client only after successful TCP listen or UDP bind registration, requires zero statuses and empty stderr, and verifies the exact payload. Stale host/dist is removed before tsx imports.

This claims Kandelo-to-Kandelo virtual TCP/UDP only. External-host pending-connect EAGAIN, SIOCGIFCONF, and IP_PKTINFO ancillary behavior remain explicit unclaimed platform boundaries.

Exact source head

Base: c5705667a90b05754d2244a362f3f7fc95d2f9c3

Head: 3cf0374c26f9784b05eaabc06b50f9d06c057c3f

Formula SHA-256: ff4c1b299e233f52d72b7cb543a33cbc94a79fde5f40f4911313e81092832e69

Embedded patch SHA-256: e1627c27294a476dd13f9d99f68fe570c9d02bb980b545743bb2baed0d4919a7

Runner SHA-256: f690442f5284cba070c49b418723386beb4c8e910d00bb42bfd5f70cf97a3f25

Five commits preserve the accepted Formula, patches, runner, support method, and public regression behavior. Range-diff differences are limited to adjacent c570 README/support-test insertion context. Exact Ruby syntax, Prettier, diff, ancestry, and clean-worktree checks pass; the current support suite passes 38 runs / 294 assertions.

Historical runtime evidence

The content-identical implementation previously established:

• ABI 18 source rebuild and literal Formula test passed for both TCP and UDP virtual-network pairs
• installed Netcat: 95,139 bytes, SHA-256 47aff4968d68227056e1cc1cea85b6d999161acbc4bd0666bf89513cc94f882b
• no fork import/continuation exports, no Asyncify, and no checkout/temp/Nix paths

That is historical source/runtime evidence, not a fresh c570, final-ABI, bottle, or Chromium-pour claim.

Gates

Source merge waits on #874, #882, and #883 for the final SDK/configure truth and authoritative ABI validation.

Publication additionally requires #887 for native build-dependency compatibility, #895 for the Formula test runtime, the consolidated ABI rebuild, trusted publisher/provenance, and stock Node/Chromium pours.

#842/#873/#888 are inapplicable because Netcat is fork-free. #900 is not package-specific because Netcat has no target runtime dependencies. #903 is unnecessary because the small artifact exposes direct ABI evidence. #905 is unrelated because Netcat does not exercise posix_spawn descendants.

This PR is the source ancestry/shared-runner base for Redis PR #40; Redis is not a Netcat runtime or bottle dependency. No bottle block or binary artifact is committed.

[brandonpayton]

Exact-head devil review: APPROVE (source scope)

Reviewed fa49b9dd1de5d1217cc6eb03086b2516ba1a0371 on tap main 33b15ba4503605f51058cc75a4a49ac278169772; the live PR head still matches and is mergeable.

Evidence: ABI 18 source rebuild and literal brew test passed exact TCP and UDP payload/status checks; the accepted Wasm is 47aff4968d68227056e1cc1cea85b6d999161acbc4bd0666bf89513cc94f882b, correctly non-forking, and free of Asyncify and host-path residue; support tests passed 31/236, plus Ruby syntax, Formula style, Prettier, and diff checks. The patches and nonfork classification match the upstream/platform boundaries described in the PR.

This approves this exact formula/source head only. It makes no bottle, dependent-bottle, or Chromium claim. Remaining gates are Automattic/kandelo#882, a hosted build of the exact pushed Tap.fetch head, and trusted bottle build/publication and guest pour validation through Automattic/kandelo#881 and #885. Do not merge or publish before those gates.

[brandonpayton]

Independent exact-head review completed for 3cf0374c26f9784b05eaabc06b50f9d06c057c3f: ACCEPT for source review.

• Five commits preserve the accepted Formula, patches, runner, support behavior, and public regression method; range-diff changes are shared c570 insertion context only.
• Current static/support evidence passes 38 runs / 294 assertions.
• The virtual-network test contract uses two isolated machines, successful backend registration gates, exact payloads, zero exits, and empty stderr.
• Netcat is correctly fork-forbidden; command mode execl replaces rather than forks.
• Source gates are #874/#882/#883. Publication adds #887/#895, the consolidated ABI, trusted provenance, and stock Node/Chromium pours.
• #842/#873/#888/#900/#903/#905 do not gate current claims.

No Formula blocker was found. Historical ABI 18 bytes remain nonpublishable evidence only. This head is safe as Redis PR #40's reviewed base.