redis: add the threaded data service and client

[brandonpayton]

Why

Kandelo users need to install and run a real network service from Homebrew, not
only command-line utilities. Redis is not yet a first-class tap package, so the
migration has not proved a threaded server and separate client communicating
over Kandelo's virtual network. Adding Redis 7.2.5 matters because it validates
service startup, client/server traffic, and process cleanup through the same
platform path that other hosted applications will use.

This PR is stacked on Netcat PR #35 because it extends the shared
LocalVirtualNetwork test runner for separate server and client programs.
Netcat is a source ancestry and test-runner gate, not a Redis runtime
dependency.

What changed

• Keep Redis's dependency-free, non-TLS package contract.
• Move module-only pointer declarations and TLS-only includes under Redis's existing TLS condition, avoiding LLVM Wasm AsmPrinter crashes on unused globals.
• Make dependency archive tools overrideable, supply Kandelo AR/RANLIB to every bundled archive, and fail closed on dependency build errors.
• Optimize, fork-instrument, and validate redis-server with fork: :required.
• Optimize and validate redis-cli with fork: :forbidden.
• Use the shared ABI/Asyncify/path validator plus a strict supported dynamic-loader env import allowlist.
• Strip only .debug_* from release executables while preserving producers and target_features.

Runtime contract

The Formula test runs SET, GET, INCR, Lua EVAL, INFO, and graceful SHUTDOWN between separate Kandelo machines. The client starts only after successful TCP listen registration; both statuses must be zero, stderr empty, and version/select/C11-atomic/shutdown markers exact.

The shared regression is public and executed by Minitest.

Exact source head

Base Netcat head: 3cf0374c26f9784b05eaabc06b50f9d06c057c3f

Redis head: 0e81c80d197f43bf270c14e9d37ec11c9ba3ddd2

The stack remains exactly two commits and five files above Netcat.

Formula SHA-256: b390fd9577c2c0ad0404a62cdbf47868662c923e8bcc67217053895aaa7a0565

Embedded patch SHA-256: b26d0f8f0fc2d0ddfe6b8992c12e868b5be7bd03cd8fac75d698bf3f71fe02a0

Runner SHA-256: 62148fcd622dafb8d4cf9ca51f7f77b2a6c2e199aab5944f007f8e08f225a683

Formula, patch, runner, Redis helper, and public regression bytes match the accepted prior series. The contract commit range-diffs identically; the functional commit differs only in README insertion context. Exact syntax, Prettier, diff, ancestry, and clean-worktree checks pass; the current support suite passes 39 runs / 300 assertions.

Historical runtime evidence

The content-identical implementation previously established:

• Redis server: 3,648,924 bytes, SHA-256 e95356df6e7dfe10ff50062eda77d706242c68badcccf609420ceb53d95435e1, ABI 18, fork-required/complete, non-Asyncify/path-clean
• Redis CLI: 356,512 bytes, SHA-256 cc285165ce09bb24fdd935ecdb99918166a3b3f3990685204b7ebbbfa12c402f, ABI 18, fork-forbidden, non-Asyncify/path-clean
• direct service execution produced zero server/client statuses, empty stderr, exact SET/GET/INCR/EVAL output, Redis 7.2.5, select/C11 atomics, and graceful shutdown

The process then remained alive until a watchdog returned 124 because cloned pthread workers were retained. This is truthful failure evidence for #892, not a passing literal Formula test; no timeout-success or process.exit workaround exists.

Source and final-byte gates

Source/platform merge waits on Netcat #35, #873, #882, deterministic #888-on-#889, and #892 after its post-#889 rebase/full rerun so the literal Redis test terminates naturally. #841 is unnecessary because Redis uses correctly typed pthread entries.

#842 and the consolidated ABI are final-byte rebuild gates.

#874/#883 are not Redis gates because this is a Make-based build without Autoconf/config.site identity consumption. #903 is not currently required because the historical server/CLI pass #882 extraction; final bytes must be revalidated. #905 is unrelated because no posix_spawn parentage assertion is made. #893 is not evidenced as required; #892 is the measured retained-worker boundary.

Publication gates

Publication stack is #881 -> #887 -> #890 -> #885 plus tap #22. #887 supplies native Binaryen/WABT. #890 is workflow context rather than a Redis dependency need. #895 is unrelated because the test stages server/client and execs no base utility. #900 has an empty same-tap closure for Redis, though the unified publisher may wait for it globally.

Final acceptance requires a final-ABI source rebuild, naturally terminating literal brew test, trusted bottle publication, and stock Homebrew Node and Chromium pours. Registry/local ABI 18 artifacts are not bottle evidence.

[brandonpayton]

Exact-head devil review: APPROVE (source scope; not runtime acceptance)

Reviewed 38693f643cf73596a5100a33b6b24f6367c87cf8 stacked on Netcat fa49b9dd1de5d1217cc6eb03086b2516ba1a0371; both live heads still match and this PR is mergeable.

Evidence: the ABI 18 source build/install completed; redis-server has the required fork contract and hash e95356df6e7dfe10ff50062eda77d706242c68badcccf609420ceb53d95435e1; redis-cli is correctly non-forking with hash cc285165ce09bb24fdd935ecdb99918166a3b3f3990685204b7ebbbfa12c402f; both are free of Asyncify, debug, and host-path residue. The exact service run produced zero guest statuses and the required SET/GET/INCR/EVAL/version/multiplexing/atomics/shutdown evidence. Support tests passed 32/242, plus syntax, style, Prettier, and diff checks.

The literal brew test is not passing: all assertions complete, then retained pthread workers require watchdog termination with status 124. That is blocker evidence for Automattic/kandelo#892, not success.

This approves this exact formula/source head only and is not merge readiness. It makes no bottle or Chromium claim. Remaining gates currently open: tap #35; Automattic/kandelo#842, #873, #882, #888, and #892; trusted publication #881/#885; the tap #22 trust-boundary blocker; hosted exact-head build; a naturally terminating literal brew test; and trusted bottle pours in stock guest Node and Chromium. Do not merge or publish before those gates.

[brandonpayton]

Independent exact-head review completed for 0e81c80d197f43bf270c14e9d37ec11c9ba3ddd2 on Netcat 3cf0374c26f9784b05eaabc06b50f9d06c057c3f: ACCEPT for source review.

• Redis remains exactly two commits/five files above its reviewed Netcat base.
• Formula, embedded patch, runner, Redis helper, and public regression bytes are preserved; current support evidence passes 39/300.
• Server fork-required and CLI fork-forbidden policies, archive-tool fixes, import allowlist, prefix maps, and debug stripping are coherent.
• Historical service output proves Redis commands, select/C11 atomics, and graceful shutdown, but watchdog 124 truthfully records #892's retained-worker failure; it is not a passing Formula test.
• Source gates are Netcat netcat: add virtual TCP and UDP workflows #35, #873/#882/#888-on-#889/#892. Final-byte gates are #842 and the consolidated ABI.
• Publication requires the trusted stack and naturally terminating final-ABI Node/Chromium pours; #895/#900 are not Redis dependency gates.
• #874/#883/#903/#905 are not current package gates.

No Formula blocker was found. No timeout or process-exit workaround is accepted.