lsof: package the upstream open-file inspector

[brandonpayton]

Why

The old registry lsof is an in-tree 0.1.0 mini /proc reader, explicitly not upstream lsof. That is not a first-class Homebrew package and must not become the tap implementation.

This change builds the official lsof 4.99.7 source archive through the Kandelo SDK and exercises the real process/open-file path.

Implementation

• add an idiomatic lsof formula from the official 4.99.7 tag
• make the two optional Linux protocol-name headers conditional; Kandelo intentionally does not expose AF_PACKET or AF_NETLINK UAPI, and upstream already guards every dependent constant
• use tap main's shared in-place fork-instrumentation helper because upstream lsof forks around guarded readlink/stat operations
• test field-mode PID, cwd, and descriptor enumeration, including the expected cwd directory type

Merge gates

Do not merge or publish this formula yet. The source build and runtime enumeration work, but the final type assertion intentionally exposes a kernel procfs defect:

• stat("/proc/<pid>/cwd") and stat("/proc/<pid>/fd/<n>") return synthetic S_IFREG metadata instead of following the procfs symlink and statting the authoritative target.
• crates/kernel/src/procfs.rs::procfs_stat handles only the no-follow symlink case; follow_symlinks=true falls through to its regular-file branch.
• sys_stat and sys_fstatat route procfs entries directly to that branch.

A standalone main-repo root-cause fix is required before this PR can pass brew test and merge. Automattic/kandelo#867 has landed; ABI-18 publication remains gated on Automattic/kandelo#842, #873, #874, #882, and #885.

Validation

On exact tap commit 2a02dc5c63e4f09c01726dc16d60aa2285d30d03 with the local ABI-18 integration stack:

• brew install --formula --build-bottle automattic/kandelo-homebrew/lsof passes
• brew style passes for the formula and support changes
• brew audit --strict --formula automattic/kandelo-homebrew/lsof passes
• brew readall --aliases automattic/kandelo-homebrew passes
• formula-support tests pass: 6 runs, 40 assertions
• brew test --verbose reaches the meaningful runtime assertion and fails only on cwd being tREG instead of tDIR; PID 100 and cwd/fd paths are correct
• real Chromium BrowserKernel runs the same artifact with exit 0 and reproduces the same tREG classification, establishing Node/browser parity of the kernel defect

Installed Wasm evidence:

Property	Value
SHA-256	33eb67ad1ce5d1a5d50c74b76338610771571f52a0454a7fcaddfc1b6ae6b4a7
Size	762,805 bytes
ABI	18 (__abi_version returns 18)
Imports	16, including kernel.kernel_fork
Fork exports	complete wpk_fork_* set
Legacy Asyncify	absent

A local, non-published bottle from the exact commit is 276,503 bytes with SHA-256 ea76b1513830f3ea998bd905346662c854682def3eadf434bd3e7d998d485d9d. No bottle block is committed; trusted ABI-18 publication must generate authoritative metadata after the gates land.

Rebase note

Rebased onto tap main at a4c52a1338190543e33623ab335618605c21a029. The formula blob remains byte-for-byte identical (dc179ed64bd1c6ee447eb223f51891ea6ff9b9f8); the old branch's shared-helper delta was dropped because current tap main already contains that helper and stronger coverage. Current formula-support validation passes with 21 runs / 186 assertions, and current formula syntax, style, and git diff --check pass. Head: 29bc5b49d7ade40e30edd1e339f1e6d6f9ec5093.

[brandonpayton]

Superseded by #80, which is restacked on current tap main, uses the official 4.99.7 release asset, eliminates embedded builder paths, and has fresh ABI 18 build/test evidence.