[Homebrew/Runtime] Read bottle prefixes from their descriptors

[brandonpayton]

Why

A published bottle tree records the exact guest paths and file sizes it
was built to create. Those values are part of the artifact contract.

The immutable rev22 shell uses the older /home/linuxbrew/.linuxbrew
prefix. Its Dash receipt starts at 929 bytes and becomes 943 bytes after
Homebrew placeholder relocation.

PR #1188 changed Kandelo's default prefix to /opt/kandelo/homebrew.
Current host code then relocated the same old receipt to the new prefix,
which produces 938 bytes. The VFS correctly rejected that result
because it did not match the descriptor's recorded 943-byte size. In
the shell demo this surfaced as /bin/sh: I/O error.

The runtime default should choose paths for new artifacts. It must not
reinterpret an immutable artifact that already records a different path.

What changes

• Derive lazy bottle relocation from the authenticated receipt path in
  each tree descriptor.
• Require every relocated inventory path, including hard-link aliases,
  to stay under that descriptor-owned package prefix.
• Pass the planned package prefix explicitly in eager and lazy builders.
• Keep the existing archive digest and relocated-size checks unchanged.
• Cover both the rev22 prefix and Kandelo's current prefix.
• Regenerate the package projection and standalone resolver bundle from
  the corrected shared host inputs.

The generated package identities changed because the legacy recipes
list the shared host VFS files as build inputs. The runtime fix itself
does not require package rebuilds. Legacy staging still rebuilt six
cache identities because those recipes broadly include shared host/VFS
files. Those outputs are transition bookkeeping, not inputs to the
rev22 proof. Regenerating the projection records the new source
identity; regenerating the bundled resolver keeps installed and
source-checkout resolution in sync.

This compatibility behavior does not make Linuxbrew Kandelo's default.
It only honors already-published immutable metadata. Newly built
artifacts continue to use /opt/kandelo/homebrew.

Validation

• Protected main d7540878b reproduces the exact rev22 failure with the
  public Dash bottle.
• This branch materializes that same shell tree and bottle. Dash is
  600,761 bytes and its relocated receipt is the expected 943 bytes.
• Bottle relocation tests passed: 5/5.
• Homebrew VFS builder tests passed: 126/126.
• Lazy VFS tests passed: 12/12.
• The standalone resolver bundle freshness test passed.
• The generated program-index context check passed.
• Complete Node and browser host bundles, including declarations, built.
• git diff --check passed.

This changes shared host/VFS behavior. It does not change the kernel or
the Kandelo ABI.

[github-actions]

Phase B-1 matrix build status — pr-1209-staging-run-30840970775-attempt-1

ABI v42. 0 built, 6 failed, 6 total.

Package	Arch	Status	Sha
kandelo-sdk	wasm32	failed	—
mariadb-test	wasm32	failed	—
mariadb-vfs	wasm32	failed	—
mariadb-vfs	wasm64	failed	—
redis-vfs	wasm32	failed	—
rootfs	wasm32	failed	—

_{Auto-generated; replaced on each push. Raw data in the publish-status workflow artifact.}

[brandonpayton]

Architectural follow-up

Keep this PR focused and preserve its tested head. In a separate
worktree, remove Homebrew policy from the generic in-memory VFS.

The VFS should own only general authenticated materialization, path
transformation, archive, link, collision, and lazy/eager contracts.
Homebrew-specific receipt, Formula, bottle, Cellar, keg, and prefix
validation should live in a Homebrew adapter that produces the generic
plan.

The follow-up must preserve the digest, relocated-size, hard-link,
path-boundary, mixed-prefix, eager/lazy, and Node/browser invariants
covered here. It must also prove that non-Homebrew archive sources can
use the same generic mechanism without pretending to be bottles.