Give zlib a new bottle identity after the build runner changed

[brandonpayton]

Why

Zlib's fresh publication retry rebuilt and tested successfully, but the immutable version index correctly rejected the new child at 1.3.1_3.wasm32_kandelo.

The existing public bottle was built on a runner whose retained Homebrew receipt records CPU family zen4. The retry ran on zen3. Kandelo deliberately retains truthful Homebrew build-environment metadata in the bottle, so that CPU change produced different archive bytes even though the Formula, support closure, target outputs, installed size, and bottle byte count were otherwise unchanged.

An immutable Homebrew reference must never be overwritten with different bytes. Retrying 1.3.1_3 again cannot resolve that conflict; zlib needs a fresh supported identity.

Evidence:

• Failed retry: https://github.com/kandelo-dev/homebrew-tap-core/actions/runs/29701321038
• Safe failure-only finalizer: 8e5bf2b
• Existing bottle layer (zen4): sha256:9aa823777633cad51e986cb0c3a74950d7ae87a2a09500ed43a02f809c0c0f36
• New unindexed layer (zen3): sha256:72099bbcc409f455d04336145d1e7cb7983fdae5d1de7a6a144ff9ddaede705d

What changed

Only the zlib Formula revision changes:

• revision 3 → 4
• package identity 1.3.1_3 → 1.3.1_4

There is no handwritten bottle block. A successful publication remains responsible for generating the bottle block and all Kandelo sidecars.

The old top index, child manifest, bottle layer, and failure evidence remain immutable and are not deleted or replaced. The newly uploaded but unindexed content-addressed child also remains harmless audit evidence.

Why target binaries and build.toml do not change

This change gives the outer Homebrew distribution artifact a new identity. It does not change zlib source, checksum, SDK/sysroot, compiler flags, build steps, target library, headers, tests, or Kandelo package archive inputs. Therefore no Kandelo build.toml revision or ABI change is required.

Validation

• ruby -c Formula/zlib.rb — passed.
• brew style Formula/zlib.rb — one file inspected, no offenses.
• bash Kandelo/test-workflow-trust.sh — passed.
• git diff --check — passed.
• Diff is exactly one Formula revision line.

Rollout

Do not merge while the active bzip2 pilot is verifying/finalizing. After the tap is quiet:

1. Rebase this one-line change onto the exact accepted tap main.
2. Merge it.
3. Submit a fresh zlib wasm32 publication; do not rerun the failed job.
4. Require all six publication jobs, clean tap validation, the public repository-linked package record, and credential-free complete OCI index import.
5. Keep tap PR getconf: report Kandelo's real POSIX configuration #4 unmerged until both zlib and bzip2 pilots are fully accepted.