[Homebrew/VFS] Define bottle-owned composable layer contract

[brandonpayton]

Why

Kandelo should be able to compose VFS features from ordinary Homebrew Formulae instead of creating one permanently bundled image per application or runtime. Formula dependencies should remain the only dependency graph, and each selected layer should carry its own system files without inventing package-specific browser rules.

This PR defines and validates that source contract before choosing a transport or publishing any layer.

What changes

• Reserve a fixed, URL-free share/kandelo/vfs-layer.json manifest inside a VFS Formula keg.
• Reserve libexec/kandelo-vfs-layer/rootfs/ as the Formula-owned payload projected onto /.
• Bind the manifest and payload to one exact dependency-first Homebrew closure, including fully named cross-tap dependencies.
• Validate canonical paths, directories, modes, symlinks, hard links, activation roots, and both per-layer and image-wide package, entry, and byte limits.
• Preflight all selected layers before mutation.
• Reuse a shared dependency once only when both layers resolve the same immutable bottle, link projection, and provenance.
• Reject package identity conflicts and path/ancestor collisions deterministically.

Stack and current boundary

This draft is stacked on #1069, which is itself stacked on #1074.

It does not yet:

• choose between mapping the original bottle directly and publishing a derived rootfs archive;
• build a runtime-layer descriptor;
• publish a VFS Formula or immutable layer release;
• claim Node.js or browser consumption support.

Those remain explicit acceptance steps. This generic host/VFS change will not merge without explicit approval after its parents land and final CI is green.

Evidence

Exact head: 0fd06b95ecc68a0a528aeb2e2c10b1ab7adda2ea

• Formula-layer, runtime-policy, and federated-planner suites: 53/53 passed
• host TypeScript declaration build: passed
• deterministic two-layer composition in either selection order: passed
• shared identical dependency deduplication and conflicting-identity rejection: passed
• git diff --check: passed

No kernel, libc, or ABI contract changes.

[github-actions]

Phase B-1 matrix build status — pr-1076-staging

ABI v41. 4 built, 5 failed, 9 total.

Package	Arch	Status	Sha
homebrew-bootstrap	wasm32	built	5abead30
kandelo-sdk	wasm32	built	2f07a46b
mariadb-test	wasm32	failed	—
mariadb-vfs	wasm32	failed	—
mariadb-vfs	wasm64	failed	—
shell	wasm32	built	feffb1d8
lamp	wasm32	failed	—
node-vfs	wasm32	built	e12fabca
wordpress	wasm32	failed	—

_{Auto-generated; replaced on each push. Raw data in the publish-status workflow artifact.}

[brandonpayton]

Maintainer approval recorded from Brandon Payton on 2026-07-22: this PR may be progressed and merged after it is restacked on the landed dependency stack and its exact final Node, Chromium, package-index, and staging validation is green.

[brandonpayton]

Integration checkpoint (not final merge evidence): both #1076 commits replay cleanly on the current #1074 + #1069 rehearsal tree. The rehearsal also regenerates composite-image package identities after the generic VFS changes. On rehearsal head 122b7ae70b1ec2bd74123a016393705f391fabf3, the Formula-layer, materialization-policy, federated-planner, VFS-builder, build-input-closure, and browser-package-ownership suites pass 197/197, host declaration generation passes, and git diff --check is clean. Final CI will still be rerun after the parent PRs land.