homebrew: let isolated Formula builds read reviewed sources

[brandonpayton]

Why

The sqlite, bzip2, and xz Homebrew pilot builds all stop immediately after brew trust, before Homebrew evaluates a formula. Kandelo intentionally runs Formula code as a separate, unprivileged Linux user, but GitHub Actions stores the checked-out Kandelo and tap repositories below /home/runner/work. That parent directory is not traversable by the Formula user. The publisher then tries to audit those original paths as that user, receives a permission error, and exits.

This blocks every bottle build on the production Linux runner even when the formula and source are valid. Simply loosening checkout permissions would weaken the isolation boundary. The build user needs a path to the exact reviewed sources that it can read but cannot modify, while the original private runner paths stay hidden.

What changed

• Create root-owned aliases for the exact Kandelo and tap source trees under a shared runner path.
• Use systemd, the Linux service manager, to bind those aliases read-only into every transient Formula service.
• Hide the original Kandelo, tap, and protected output paths inside the service, and rewrite both Kandelo root environment variables to the read-only alias.
• Verify each alias with the protected /usr/bin/findmnt tool and reject any mount that is not read-only.
• Preserve the real error text when a source-tree audit fails instead of turning the failure into an empty result.
• Keep the patched Homebrew overlay recursively non-writable and non-replaceable. Its backing Git checkout is not masked because it owns the live worktree that Homebrew is executing; the build does not need write access to that backing checkout.
• Remove aliases only after Formula processes have stopped and protected artifacts have been inspected.

This is a Linux continuous-integration isolation fix. The non-Linux launcher path is unchanged. It does not change Kandelo runtime behavior, Node.js/browser behavior, package bytes, or the Application Binary Interface (ABI).

Validation

Run on exact commit 9d3cf759df1710d071605aeca5e9feaac0d5a40d / tree 0b38eee5d1549623a094a9e4f241e2ec9c5354f5:

• Native Ubuntu 24.04 with systemd 255: full Linux launcher fixture passed with a mode-0700 checkout parent, verified read-only aliases, hidden original paths, preserved identity/arguments, no-new-privileges enforcement, detached-process teardown, and account deletion.
• ./scripts/dev-shell.sh bash scripts/test-homebrew-patched-launcher.sh passed on macOS; its Linux-only systemd branch skipped as designed.
• ./scripts/dev-shell.sh ruby scripts/check-homebrew-publish-workflow-trust.rb passed.
• ./scripts/dev-shell.sh bash scripts/test-homebrew-publish-workflow.sh passed.
• Shell syntax and git diff --check passed.
• Independent security review found no blocking issue.

Hosted Linux continuous integration remains the production evidence for the systemd path. This source commit is intended for the broad non-ABI release-control batch, where the aggregate gates will run once.

[brandonpayton]

Closing as superseded by #957. That PR preserves the generic tap-identity change as its first commit and carries this reviewed-source alias implementation as its second commit, with the additional exact-mapping trust checks and two-alias write-protection assertions requested during review. No implementation from this PR is being dropped. Superseded exact head: 9d3cf759df1710d071605aeca5e9feaac0d5a40d.