[Sunrisepeak]

Homebrew installation CI could accept the previous release when its matching formula and binary were installed before the asynchronous tap update. Native ARM64 release validation also assumed writable controller paths, a specific progress banner and GNU checksum tools on macOS.

Resolve one published version for all installation jobs, wait for that exact tap version without pre-tapping, and reject stale or mismatched installed versions. Preserve Homebrew upgrade errors. Prepare native bwrap with the published xlings isolation doctor and place cold consumer state within the selected SubOS instance's writable subtree. Assert the default ARM64 toolchain through the public build-database output and use each target platform's native checksum command.

The verification consumes the sealed public release, retains controller read-only isolation and the hidden host checkout, and requires actual native builds, deployment, ecosystem consumers and execution of all three cross-target artifacts. It adds no product compatibility behavior or new manifest fields.

Closes #828

Validation:

• Three tests execute the actual Homebrew verification block. They reject a matching old formula/binary and a mismatched binary; the requested release passes. The original block accepts the stale matching pair.
• All 18 existing workflow assertion tests and all 25 workflow checks pass. Bash syntax, version-pin checks and whitespace checks pass.
• Both macOS 14 and macOS 27 Homebrew jobs installed 2026.10.21.1 and built and ran a real hello project.
• Native ARM64 public CN validation passed on the final head: cold install, default LLVM 23.1.3, native build/run/pack, Openkal, four consumers, and actual execution of cross-target artifacts on Linux, macOS and Windows (run 39487266234).
• Complete fresh-install workflow passed all 18 jobs (run 39482875872), including all four Linux toolchain self-builds. Its workflow and installation guard are unchanged between that tested head and this final head.
• Final-head PR CI passed all 67 executed jobs, with one platform-conditional job skipped (run 39487477523).
• Final self-review checked architecture, upgrade compatibility, cross-platform behavior, exact artifact identity and isolation boundaries.

The product changes, specifications, documentation and release version were delivered together in #827. This follow-up maintains release verification; tag v2026.10.21.1 and its published assets remain unchanged.