feat: add secure multi-version Valhalla support

[trumpyla]

Summary

• add versioned openjdk-valhalla@27 and openjdk-valhalla@28 source formulae plus a rolling alias
• preserve the existing jdk26ea formula and cask tokens and installation locations
• repin the legacy token to the current official OpenJDK 26.0.2 GA archives after the retired EA artifacts began returning 404
• document bottle versus source installation and jEnv integration
• add a source-built bottle workflow with strict provenance and artifact validation
• harden validation and release workflows with least-privilege tokens, immutable action pins, fail-closed checks, and non-replaceable release tags
• remove obsolete JDK 26 EA update/release automation so published release scope remains Valhalla-only

Security

The bottle build runs with read-only repository access and no persisted checkout credential. The publish job revalidates exact bottle metadata and checksums before receiving a step-scoped write token. Release tags are atomically bound to the dispatched commit and releases are immutable.

Repository policy is configured for read-only default workflow tokens, full-SHA Action references, immutable releases, an app-bound required validation check, review approval, latest-push approval, conversation resolution, and admin enforcement.

Validation

• required GitHub Validation Status: passed
• macOS cask installs: passed on Apple Silicon and Intel
• Linux formula installs: passed on Ubuntu 22.04 and 24.04
• workflow security tests: 8 runs, 94 assertions
• bottle artifact validator tests: 4 runs, 11 assertions
• formula compatibility contract: 4 passing Bats tests
• all four official JDK 26.0.2 archive URLs returned HTTP 200
• Actionlint
• ShellCheck
• workflow YAML parsing
• Ruby syntax
• Homebrew style
• strict Homebrew formula audits
• git diff --check

A full OpenJDK Valhalla source build and tier-one test run were not repeated; the previous long-running build was intentionally interrupted.

[Copilot]

Pull request overview

This PR migrates the tap from “JDK 26 EA auto-updates” toward a Valhalla-focused, multi-version packaging model, while preserving the legacy jdk26ea token/paths by repinning it to current OpenJDK 26.0.2 GA archives and removing obsolete EA automation.

Changes:

• Add pinned, source-built Valhalla formulae (openjdk-valhalla@27, openjdk-valhalla@28) plus a rolling alias and documentation for bottles/source installs and jEnv.
• Introduce a manually dispatched bottle build/publish workflow with artifact validation, plus new workflow-security and validator tests.
• Update legacy jdk26ea formula/cask to OpenJDK 26.0.2 GA URLs/checksums and remove the retired EA update/release workflows.

Reviewed changes

Copilot reviewed 21 out of 21 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
tests/workflow_security_test.rb	Adds CI-enforced workflow security contracts (action pinning, permissions, persisted credentials, bottle immutability checks).
tests/formula_contract.bats	Adds a compatibility/contract test for Valhalla formula presence + legacy token invariants.
tests/bottle_artifact_validator_test.rb	Adds tests for the bottle artifact validator script and its outputs.
SECURITY.md	Rewrites security policy for Valhalla + legacy compatibility scope and workflow/bottle controls.
scripts/validate-bottle-artifact.rb	New validator to fail-closed on bottle artifact shape, metadata, filenames, and checksums.
scripts/update.sh	Removes obsolete JDK 26 EA auto-update helper script.
scripts/test.sh	Extends local validation to run the new Bats compatibility contract and style-check all formulae.
README.md	Updates documentation to “Homebrew Valhalla”, describes tokens, install modes, bottles, and jEnv usage.
Formula/openjdk-valhalla@28.rb	Adds pinned source-build formula for Valhalla 28 snapshot with smoke test.
Formula/openjdk-valhalla@27.rb	Adds pinned source-build formula for Valhalla 27 JEP 401 milestone with smoke test.
Formula/jdk26ea.rb	Repins legacy token to OpenJDK 26.0.2+10 GA archives and adjusts test expectation.
Casks/jdk26ea.rb	Repins legacy cask to OpenJDK 26.0.2 GA archives while preserving install location/token.
.github/workflows/validate.yml	Hardens permissions, disables persisted checkout credentials, and adds lint + security/validator test jobs.
.github/workflows/update.yml	Removes obsolete scheduled EA update workflow.
.github/workflows/release.yml	Removes obsolete release workflow tied to EA version bumps.
.github/workflows/bottles.yml	Adds manual Valhalla bottle build/publish workflow with validation + PR creation.
.github/workflows/auto-update.yml	Removes obsolete scheduled EA auto-update workflow.
.github/workflows/audit.yml	Extends audit workflow to style/syntax-check all formulae.
.github/workflows/first-time-contributor.yml	Updates actions/first-interaction pin to a newer immutable commit.
ABOUT.md	New document describing provenance, release model, and migration/compatibility policy.

Comments suppressed due to low confidence (2)

tests/workflow_security_test.rb:83

• This test enumerates workflow files with YAML.load_file, which is unsafe for untrusted PR content because YAML tags can deserialize objects. Switch to YAML.safe_load_file (and keep aliases disabled) to avoid object injection during CI.

      workflow = YAML.load_file(path)

tests/workflow_security_test.rb:56

• If the "Confirm completion" step is missing or renamed, confirm_step will be nil and subsequent assertions will raise NoMethodError. Assert it exists so the test reports a clear failure.

    confirm_step = status_job.fetch("steps").find { |step| step["name"] == "Confirm completion" }