mariadb: add the relational database service

[brandonpayton]

Why

Kandelo applications need a relational database that can be installed from
Homebrew and run as a real service. MariaDB is not yet a first-class tap
package, so the migration has not proved database initialization, authenticated
network queries, encryption-library linkage, or clean shutdown from a declared
Homebrew dependency set. Adding MariaDB 10.5.28 matters because those are the
normal database workflows that hosted applications will rely on.

What changed

• Builds native CMake generators with portable host cc/c++, then cross-compiles the target programs with the worktree-local Kandelo SDK.
• Declares exactly five target dependencies: libcxx, ncurses, OpenSSL, PCRE2, and zlib.
• Forces the target build to use the exact static OpenSSL archives from the declared tap keg.
• Fails closed if CMake selects bundled WolfSSL, the linker omits the declared OpenSSL archives, or final artifacts contain WolfSSL or host-build paths.
• Installs mariadbd, mariadb-test, bootstrap SQL, character sets, and generated error catalogs.
• Exercises bootstrap, TCP startup, an authenticated query, OpenSSL identity, SQL shutdown, process exit, and exactly three successful fork descendants.

Reviewed state

• Base: 8cfd5b660980000fc463a560e8d555e078929e8d
• Head: 2b164d21141bdad042d1d7eb05dc7dca815d0a72
• Tree: 2b92ca19b2c2dcd25566d266c6a7d32ab754d885
• Formula SHA-256: fd58752aaaf137ec7ed4b15fe3a09ff141755f52258939c058a9a1ea7d54bd33
• Source SHA-256: 0b5070208da0116640f20bd085f1136527f998cc23268715bcbf352e7b7f3cc1

An independent devil's-advocate review accepted this exact head and tree with no blocking Formula findings.

Validation evidence

The exact Formula was source-built against the integrated platform preview containing #913 and #842. The lifecycle passed bootstrap, TCP query, OpenSSL identity, shutdown, and exact descendant accounting.

Artifact	SHA-256
mariadbd	2dd863c1e0d102e8db322146477512d29a89c8275e76b7c6f76db5f7f70cbba3
mariadb-test	a6b79aa7996c6ebea6ef166300b11753e34ec814767c8297c2c7563e9ae4ca12

Both artifacts report ABI 39, contain the expected OpenSSL 3.3.2 identity, reject WolfSSL markers, and contain no Nix, user, or temporary build paths. The installed Formula is byte-identical to the reviewed Formula. Ruby syntax, brew style, source verification, patch application, dependency/receipt inspection, Wasm archive inspection, and git diff --check pass.

This is one exact source build of the TLS-bound candidate. A second-build reproducibility result and an all-poured dependency-bottle lifecycle are intentionally not claimed.

Merge and publication gates

1. Land the platform train containing #913 and the corrected #842 SDK stack floor.
2. Land #936 before publishing bottles.
3. Publish ABI 39 bottles dependency-first for libcxx, ncurses, OpenSSL, PCRE2, and zlib.
4. Build MariaDB from that poured bottle closure and run the stock Homebrew Node and Chromium bottle lifecycle.

No bottle block or binary artifact is committed by this PR.

[brandonpayton]

Independent devil review at exact refreshed head fa6f905b7fc2654493f273c187dbc77b12fabdda: ACCEPT the source-contract refresh; do not merge yet.

The original Formula is patch-identical after restacking on current tap main. The shared validator runs after conditional instrumentation and wasm-strip, so it inspects the exact bytes copied into the keg. fork: :auto preserves the intended conditional policy while adding fail-closed ABI/tool checks, Asyncify rejection, exact fork import/export consistency, and broader path rejection. Removed Node checks are fully subsumed; MariaDB's compiled-module and host-import allowlist remains unchanged. Binaryen is correctly declared for wasm-dis and WABT remains declared for wasm-objdump/wasm-strip.

Fresh dev-shell evidence: Ruby syntax; Homebrew style; shared support 30/221; and exact branch diff check pass. No refreshed source build, runtime test, Chromium run, bottle, or pour is claimed.

The old dependency gates #8/#37 are resolved. Remaining source merge gates are main #882 and the real browser fixture defect: /data is root-owned while mariadbd runs as uid/gid 101. The historical Chromium pass used an uncommitted ownership overlay, so a main-owned VFS fix and clean exact Chromium rerun are still required. Publication remains dependency-first and must prove prior bottles were poured without source fallback.

[brandonpayton]

Platform ownership gate opened as Automattic/kandelo#896 at exact head ebb2a09f3b34e0d00b68791c207caa52d3192018.

Evidence on that branch:

• rebuilt the mariadb-test VFS through its package build path
• Chromium test 1st passed with MariaDB running as uid 101
• the same rebuilt image reached a listening MariaDB service under NodeKernelHost
• shared VFS uid/gid/mode tests passed (35/35 across the focused set)

This validates the Kandelo platform fixture using resolver-managed registry artifacts. It is deliberately not a claim that the MariaDB formula or its dependencies were poured from Homebrew bottles. That exact bottle-backed proof remains gated on the publisher and dependency receipts.

[brandonpayton]

Independent exact-head review completed for 37ae32c2245428255071246ec4e8ef96483a990e: ACCEPT for source review; not merge/publish ready.

• Two-commit content preservation, source hash, exact four-dependency receipts, support 37/279, style/audit/readall, and artifact contracts pass.
• Two pre-#842 builds are reproducible but fail because the 64 KiB main stack overwrites pthread-key BSS; the exact trap/key/table/data evidence rules out a Formula or destructor-linkage defect.
• Rebuilding the unchanged Formula with #842 supplies BSS + 8 MiB and passes bootstrap, listen, Aria query, shutdown, and clean exit.
• Artifacts are ABI 18, fork-free, Asyncify-free, path-clean, and readable by #882 even at 13.4 MB.
• Source/runtime gates are #842/#882/#896. Final publication waits exact #907/ABI39, prior libcxx/ncurses/PCRE2/zlib bottles under #900, trusted provenance, and stock Node/Chromium lifecycle pours.
• #888 is only relevant to the ephemeral test supervisor; #903/#905 are not separate package gates.

No Formula blocker was found. ABI 18 bytes remain nonpublishable evidence only.