homebrew: certify browser runtime for rootfs/shell package set (kd-1mr.5)

[brandonpayton]

What

Certifies the wasm32 browser runtime for the kd-0hns rootfs/shell Homebrew
package set (kd-1mr.5). Runs in-browser smokes (headless Chromium via Playwright,
BrowserKernel) for all 12 packages and records the result in each Homebrew
sidecar.

• Certified browser_compatible=true (10): dash, git, vim, less, lsof, nano, netcat, wget, bzip2, xz. Each boots in-browser from its poured VFS and passes a
  package smoke (exit 0 + expected output).
• Skipped with reason_code (2): modeset (framebuffer-device-required,
  /dev/dri) and fbdoom (framebuffer-and-iwad-required, /dev/fb0) -- device/
  framebuffer programs that the non-interactive terminal smoke cannot exercise
  (mirrors the Node framebuffer skips). Encoded as browserFormulaUnsupportedReason().

Sidecars were regenerated via cargo xtask homebrew-sidecars (not hand-edited),
so provenance metadata/formula/link shas stay consistent.

Verification

• cargo xtask homebrew-validate --tap-root test-runs/kd-0hns/rootfs-shell-tap ->
  homebrew-validate: ok (packages=12, bottles=12, link_manifests=12, provenance_reports=12)
• Browser smoke: 23 pass / 0 fail / 2 skip (test-runs/kd-1mr.5/browser-smoke/summary.json)
• homebrew-composite-status (browser): vim-browser-bundle/browser moves skip
  -> pass; no browser_compatible=false blocker remains for any of the 12. With
  core (kd-0k6q) metadata added, rootfs/browser is blocked only on bash+ncurses
  and shell/browser on bash/ncurses/curl/nethack (kd-1mr.4) + modeset/fbdoom
  (framebuffer follow-up).

Stacking / review note

This branch is based on kd-0hns (#811) (the rootfs/shell tap) and brings in the
kd-v3fs browser tooling required to run the smokes
(homebrew-package-browser-smoke.ts, homebrew-composite-status.ts,
homebrew-package-smoke-cases.ts, homebrew-smoke-outcomes.ts, the
apps/browser-demos/pages/homebrew-smoke/ page, homebrew-vfs-planner.ts,
vite.config.ts). Those tooling files are kd-v3fs's and will dedupe when kd-v3fs
merges. The net kd-1mr.5 contribution is the browser certification (sidecar
updates under test-runs/kd-0hns/rootfs-shell-tap/Kandelo/), the tailored smoke
cases (dash/lsof/netcat) + framebuffer skip logic, and the evidence artifacts
under test-runs/kd-1mr.5/. Suggested merge order: kd-0hns -> kd-v3fs -> kd-1mr.5.

Follow-ups

• Dedicated browser framebuffer/device smoke for modeset/fbdoom.
• Adopt the kd-v3fs formula.schema.json (permits runtime_status) so browser
  reason_codes are recorded in-sidecar, not only in artifacts.
• rootfs/browser + shell/browser full pass depend on kd-1mr.4 landing
  bash/ncurses/curl/nethack.

See test-runs/kd-1mr.5/DISPOSITION.md for the full method and per-package detail.

🤖 Generated with Claude Code

[github-actions]

Phase B-1 matrix build status — pr-816-staging

ABI v16. 36 built, 6 failed, 42 total.

Package	Arch	Status	Sha
libcurl	wasm32	failed	—
libcxx	wasm32	built	309bed52
libcxx	wasm64	built	97469b49
libpng	wasm32	built	da19660c
libxml2	wasm32	failed	—
libxml2	wasm64	failed	—
openssl	wasm32	built	7147c05c
openssl	wasm64	built	b6a3f9b1
sqlite	wasm32	built	29fd8435
sqlite	wasm64	built	5e9ff2df
zlib	wasm32	built	90cf6353
zlib	wasm64	built	64f7dfc9
bc	wasm32	built	de85184a
coreutils	wasm32	built	27ddf559
diffutils	wasm32	built	5f6c2432
dinit	wasm32	built	a31a9b89
file	wasm32	built	54db045a
findutils	wasm32	built	8c37f324
gawk	wasm32	built	28cac8a6
grep	wasm32	failed	—
gzip	wasm32	built	54a71b67
hello	wasm32	built	2c152ee8
kandelo-sdk	wasm32	built	27ae1cb3
kernel	wasm32	built	b0cf812f
m4	wasm32	built	b2e8d996
make	wasm32	failed	—
mariadb	wasm32	built	76b7be27
mariadb	wasm64	built	8d87af85
msmtpd	wasm32	built	5dec8fca
nginx	wasm32	built	11e38a46
php	wasm32	failed	—
posix-utils-lite	wasm32	built	7e291a98
sed	wasm32	built	b5c5f32b
spidermonkey	wasm32	built	49ef9232
tar	wasm32	built	b38257d8
tcl	wasm32	built	599fd76a
unzip	wasm32	built	01f2d4d4
userspace	wasm32	built	355492ee
zip	wasm32	built	1e0b11f2
zstd	wasm32	built	6a8c2f1f
node	wasm32	built	3210297a
spidermonkey-node	wasm32	built	fa666ecc

_{Auto-generated; replaced on each push. Raw data in the publish-status workflow artifact.}