Docs: Make Homebrew publishing operations truthful and executable

[brandonpayton]

Why

Kandelo's Homebrew migration now uses a public, repository-rooted GitHub Container Registry path and a caller-scoped built-in GITHUB_TOKEN, but the authoritative runbook did not give operators one complete, current procedure for that workflow. It also left room to mistake a successful build, immutable child upload, or browser smoke for a finalized bottle or durable VFS release.

That ambiguity can lead maintainers to restore the retired package personal access token (PAT), rerun an old write workflow after its trust pin changes, overwrite or delete unfinished registry state, treat the historical tap as a fallback publisher, or advertise an interrupted VFS draft as a public product. The live external M4 canary also proved more than the old checkpoint recorded—its Node, Chromium, and tap-finalization gates passed—but its immutable release remains an empty draft that current production code cannot rediscover.

This draft supersedes the older documentation proposal in #1012 and is restacked on current main at c14b51d4b63e2868d274456cf5bbc663e398e476.

What changed

• Add an operator map that distinguishes upstream Homebrew package semantics from Kandelo's isolated registry transport, VFS, and evidence contracts.
• Record the proved public-package default: repository-rooted GHCR packages, the caller's ephemeral built-in token, anonymous readback, no production package PAT, and no visibility mutation.
• Define exact caller/trust-pin rotation, candidate/base trust signals, bounded dependency-ready dispatch, fresh-dispatch retry rules, and fail-closed recovery for unfinished public version indexes.
• Document immutable VFS release prerequisites, assets, exact-identity checks, and the current interrupted-draft boundary without presenting PR Homebrew: Prepare complete browser inputs and resume interrupted VFS releases #1019 as shipped.
• Record completed zlib/bzip2 cutover evidence, keep destructive legacy-package deletion separately authorized and recoverable, and record the completed shutdown of Automattic/kandelo-homebrew publication authority.
• Correct the migration checkpoint: M4 already passed Node, Chromium, and tap finalization; only reviewed immutable-release recovery and publication remain.
• Replace non-existent shorthand validator examples with the repository-supported host-targeted cargo run -p xtask command.

Dependency and readiness

This PR is intentionally a draft while #1019 remains open. It does not contain or claim the pending browser-input and authenticated draft-discovery implementation. The File/Hello retries and interrupted M4 draft recovery require #1019 to merge, the appropriate tap caller to rotate to the exact merge commit, and a fresh dispatch whose release tag, target tap commit, and assets satisfy the fail-closed identity checks.

If #1019 merges before this documentation, refresh the current-main wording and preserve the distinction between merged Kandelo code and the live tap's still-pinned publisher generation. Do not mark this PR ready merely because #1019's repository checks pass; the live pin and publication evidence remain separate gates.

Validation

• git diff --check
• Markdown fence balance for all three changed files
• Local Markdown target and anchor validation: 12 links checked
• bash scripts/dev-shell.sh ruby scripts/check-homebrew-publish-workflow-trust.rb
• bash scripts/dev-shell.sh npm run docs:build
• Documented host-targeted live-tap validation against Kandelo-dev/homebrew-tap-core@58dff9996dd0f4d497ba941b6169d41ec4435a23: homebrew-validate: ok (packages=48, bottles=55, link_manifests=55, provenance_reports=55)
• Live API audit: production zlib/bzip2 packages are public and repository-linked; private tap-core/* controls retain their recorded timestamps; Automattic/kandelo-homebrew is archived with repository Actions disabled and its three publisher callers removed.

Scope

This is documentation and checked-in tap-template documentation only. It does not change workflows, package bytes or revisions, registry/release objects, runtime behavior, browser behavior, or the ABI. Runtime and conformance suites were not run because no implementation changed.