Lane 13: Build full LibreWolf-derived BearBrowser binaries through Nix

[mdheller]

Implement the full browser binary build path for BearBrowser.

Scope:

• Consume generated overlay workspace from scripts/apply-sourceos-overlays.sh.
• Build the LibreWolf-derived browser source for human-secure and agent-runtime variants.
• Keep generated browser source out of Git.
• Emit release metadata including upstream LibreWolf ref, BearBrowser revision, patch-stack hash, profile, target system, and policy contract hash.
• Connect Nix outputs to real browser binaries rather than metadata/profile packages only.

Acceptance criteria:

• Nix can build at least one full BearBrowser binary target.
• Human and agent runtime variants remain separate.
• Build inputs are pinned and reproducible.
• Build artifacts include release metadata.
• Browser source remains generated/disposable and is not committed.

[mdheller]

Progress update on main:

Completed:

• Added manifests/binary-build-plan.yaml.
• Added scripts/bearbrowser-build-binary.sh.
• Added scripts/emit-release-metadata.sh.
• Added scripts/verify-binary-build-lane.sh.
• Added Nix placeholder outputs .#bearbrowser-human-secure-binary and .#bearbrowser-agent-runtime-binary that fail closed until the real compile step is implemented.
• Exposed bearbrowser-build-binary through the BearBrowser Homebrew Formula.
• Promoted the updated Formula to SourceOS-Linux/homebrew-tap.
• Added .github/workflows/binary-build-lane.yml.

Current status:

• Binary build lane dry-run is now explicit and CI-verifiable.
• Release metadata is emitted for both profiles.
• Generated LibreWolf source remains disposable and outside Git.

Still open:

• Wire actual LibreWolf build tooling inside the generated overlay workspace.
• Make at least one Nix binary output build a real browser artifact.
• Preserve separate human-secure and agent-runtime binary outputs.