Use the verifier that recognizes Homebrew's manifest downloads

[brandonpayton]

Why

The zlib and bzip2 pilots reached a successful anonymous Homebrew download, bottle pour, and Formula runtime test, but the old verifier rejected Homebrew's normal GitHub Container Registry (GHCR) manifest log line. Automattic/kandelo#988 fixes that false failure and merged as immutable commit 353b9f818ac46ad0c7eb7b5bbc692aaab3c1af6c.

This tap still calls the older #985 workflow. Retrying the pilots before rotating the pin would therefore reproduce the same known verifier failure. The tap callers and their trust root must move together so production cannot mix workflow generations.

Automattic/kandelo#987 merged afterward as current main commit c69d3d2baae22efabdc8d570b158396953bd8429; it changed documentation only. Production continues to require kandelo-ref: main, while the reusable workflow itself is purposefully pinned to the code-bearing #988 merge.

What changed

• Pin production bottle publishing to the #988 merge.
• Pin dry-run publishing and bottle maintenance to the same workflow generation.
• Make #988 the only current trusted publisher SHA.
• Move #985's SHA into the immediately previous generation so the trust tests explicitly reject it.
• Preserve historical failure reports and the retired repository-canary pin unchanged.

Validation

• ruby -c Kandelo/test-workflow-trust.rb — passed.
• ruby Kandelo/test-workflow-trust.rb — passed.
• bash Kandelo/test-workflow-trust.sh — passed.
• git diff --check — passed.
• The diff is limited to five pin/trust lines in four files.
• Repository-wide SHA counts match the intended trust history: four #988 references, three #985 references including two historical reports, and two older historical-report references.

The candidate publisher-trust check must pass. The base-owned publisher-trust-base check is expected to fail because this PR intentionally changes protected caller/trust files; that failure is the review gate, not a publisher defect.

Rollout

After the candidate trust check and the merged #988 staging run are green, merge this tap-only update. Then retry zlib 1.3.1_3 and bzip2 1.0.8_2 concurrently without changing their identities. Tap PR #4 remains unmerged until both pilots are accepted.

[brandonpayton]

Candidate trust is green: https://github.com/kandelo-dev/homebrew-tap-core/actions/runs/29700717089/job/88229200961

The base-owned check failed at its intended review boundary with exactly:

base-owned trust contract changed: .github/workflows/dry-run-bottles.yml

That is expected for this coherent caller/trust-root rotation. The candidate parser accepted the complete new generation, and the local Ruby parser, shell wrapper, syntax check, and git diff --check all passed. I am holding merge only until Automattic/kandelo #988's post-merge staging run reaches a green terminal result.