[Homebrew/Build] Stop incomplete VFS images before publication

[brandonpayton]

Why

A VFS image is a product artifact. If its builder cannot read a required source file, runs out of image capacity, drops a required symlink, or cannot copy a declared test fixture, the build must fail before any partial image can be published.

Several image paths checked these conditions only after writing an output, or treated missing inputs as optional. That could produce an incomplete artifact whose missing files were discovered only much later at runtime.

What changes

• Make the shared host-tree copier propagate read, write, capacity, unsupported-entry, and required-symlink failures. Intentional omissions still use explicit exclusion rules.
• Require shell-derived images to use the reviewed capacity profile, or an explicitly larger reviewed limit.
• Pass the expected maximum image size into VFS serialization so an oversized image fails before the output is written; retain the post-write assertion as a second check.
• Make the Homebrew VFS builder use that pre-write capacity contract.
• Make MariaDB test packaging require every curated test plus nonempty include and std_data fixture trees instead of silently skipping missing inputs.
• Correct the curated MariaDB 10.5.28 list to the 184 tests that actually exist in the pinned source archive.
• Add failure-path coverage that proves read failures, serialization failures, missing sources, missing fixtures, symlink loss, and capacity drift cannot leave a publishable output.
• Refresh the atomic package projection because the package build inputs changed.

Validation

Validated at exact head bfd033c46c45ca332c98175d062a7073efbb6e83:

• 97/97 focused VFS, package, capacity, and runner tests passed.
• The pinned MariaDB 10.5.28 source copied all 184 declared tests and both required fixture trees.
• Host TypeScript declaration generation passed.
• Program projection and full source-context checks passed.
• The exact committed-projection xtask test passed.
• Main-shell closure checks passed.
• MariaDB browser-runner shell syntax and git diff --check passed.

A fresh staging package rebuild and browser gate are intentionally delegated to CI.

Stack and rollout

This draft is stacked on #1073, which introduces the atomic package projection used here. It must land after #1073.

Successful source trees still produce complete VFS images through the normal builder. This PR does not change the kernel, libc, guest syscall behavior, or Kandelo ABI.

[github-actions]

Phase B-1 matrix build status — pr-1068-staging

ABI v41. 6 built, 2 failed, 8 total.

Package	Arch	Status	Sha
kandelo-sdk	wasm32	built	2f07a46b
mariadb-test	wasm32	built	1ec82027
mariadb-vfs	wasm32	built	6de85a49
mariadb-vfs	wasm64	built	b3dc3d08
shell	wasm32	built	feffb1d8
lamp	wasm32	failed	(prev e922dc30)
node-vfs	wasm32	built	e12fabca
wordpress	wasm32	failed	(prev 6632c846)

_{Auto-generated; replaced on each push. Raw data in the publish-status workflow artifact.}