homebrew: let each tap publish bottles from reviewed sources

[brandonpayton]

Why

Kandelo needs the same bottle publisher to work for the default tap and for third-party taps. Two separate assumptions currently prevent that.

First, the publisher treated a GitHub repository name and a Homebrew tap name as one value. They are different for a normal tap: repository Example/homebrew-tools becomes Homebrew tap example/tools. The repository name decides who may publish and where GHCR stores bottles. The tap name decides Formula names and Homebrew install paths. Mixing them sends authority or artifacts to the wrong place. Accepting arbitrary names would be unsafe too, because another repository must not be able to claim Kandelo's protected first-party tap name.

Second, Formula builds run as a restricted Linux user. GitHub's runner checkout can live below private parent directories that this user cannot traverse, so the build cannot read the reviewed Kandelo and tap sources. Making those checkout directories broadly accessible would weaken the isolation that keeps Formula code away from publisher credentials and output files.

This PR gives each identity one clear job and exposes reviewed source trees through root-owned, read-only views. The Formula can read exactly the source it needs, while the original checkouts and publication output remain hidden.

What changed

This PR intentionally keeps two independently reviewable commits:

1. c55409a96d3fbe191d9e07b8428891e15a46ffd6 separates repository identity from Homebrew tap identity.

   • The calling repository must be the repository receiving tap commits and GHCR packages.
   • A conventional repository such as Example/homebrew-tools must map to tap example/tools.
   • Mismatched identities, nonstandard third-party repository names, and aliases of the protected automattic/kandelo-homebrew tap are rejected.
   • Repository identity now controls checkout and GHCR paths; tap identity controls Formula and Homebrew install paths.
   • Internal publication receipts were versioned so old receipts fail clearly under the new rules.

2. 0030dd5856544aef41c553ce70f77895995b28fd lets the restricted Formula user read reviewed sources without weakening isolation.

   • The Linux systemd service receives root-owned, read-only aliases for the Kandelo and tap source trees.
   • The original source paths and bottle output path are inaccessible inside Formula execution.
   • The launcher verifies both aliases are read-only mounts before starting Homebrew.
   • The trust checker seals both exact bind mappings and all three hidden paths.
   • The Linux fixture distinguishes the two source trees, verifies the originals and output are hidden, and proves writes through both aliases fail.

The first-party maintenance workflow remains first-party-only because it can roll back or delete default-tap state. A third-party tap may use the generic publisher to rebuild its own bottles, but generic rollback and deletion are outside this PR.

This change does not modify Kandelo's ABI.

Validation

Exact reviewed head: 0030dd5856544aef41c553ce70f77895995b28fd
Exact reviewed tree: 730f22252fc10832c15f54f38eb416ba34b17ab3

Passed locally through scripts/dev-shell.sh on the exact head:

• ruby scripts/check-homebrew-publish-workflow-trust.rb
• bash scripts/test-homebrew-patched-launcher.sh
• bash scripts/test-homebrew-publish-workflow.sh
• bash tests/scripts/package-publish-flow.sh
• bash scripts/check-abi-version.sh
• Ruby and shell syntax checks for changed executables
• recomputation of all six sealed publisher job digests
• git diff --check

The local host was macOS, so the launcher test covered its non-Linux path. Before consolidation, the same source-alias implementation from #958 passed the full privileged fixture on Ubuntu 24.04 with systemd 255. The extra exact-mapping trust assertions and two-alias fixture assertions added during consolidation still require the hosted Linux gate on the integration batch.

Independent review of exact head 0030dd585 found no remaining blockers.

Merge plan

This is a source-review PR, not the merge unit. It should be absorbed as these two preserved commits into the broad non-ABI integration batch, where the hosted union gates run once. Do not merge this source PR directly.

[brandonpayton]

Absorbed by rebase-merged #967. Main is now 6efb411 with the sealed tree b133bfa018f7e2bc84c4845edf2f945b2f844954, and ABI 41 activation completed successfully in run 29550069085. The absorption audit confirmed this PR\x27s behavior and tests are present in that merged tree, so this source PR is closed and its branch is deleted.