fix: harden tap bump against layout changes and bad downloads

[inureyes]

Problem

update_homebrew_formula.yml rewrote each checksum by line position:

gsed -i "/ARTIFACT\"/!b;n;c\      sha256 \"${sha}\""

It matched the url line, advanced one line (n), and replaced whatever it landed on (c\). That is correct only while sha256 sits directly beneath url inside an on_macos / on_linux block, which is how the three bssh formulae happen to be written today. Nine substitutions depend on it.

lablup/mlxcel ran the same construct, copied from the same source. When its formula moved the url to the top level with a version stanza in between, the next bump overwrote version with the new checksum and left the previous release's sha256 below it:

  url ".../v0.4.3/mlxcel-macos-aarch64.zip"
      sha256 "dea8a5c2..."   # new hash, wrong indent, replaced `version`
  sha256 "83a0b702..."       # stale v0.4.2 hash, and this is the one that wins

No version stanza, two sha256 lines, brew install failing on checksum. Nothing validated the result and it sat broken in the tap for three days (lablup/homebrew-tap 9969ec4).

bssh is not broken today, but it is one formula edit away from the same outcome, with three times the exposure.

Fix

Stanzas are located by name. set_artifact finds the url stanza whose value contains a given artifact, rewrites it, then rewrites the first sha256 stanza below it, preserving indentation. Anything in between is skipped rather than clobbered. Guards abort when a formula does not hold exactly one matching url, or when no sha256 follows it.

Two other faults surfaced while fixing this:

• curl -Ls with no -f. A missing or renamed asset produced a zero-byte file whose checksum went to the tap unnoticed. Now -f --retry 3, plus an empty-file check and an archive integrity check (unzip -t / tar -tzf), so a truncated download cannot become a valid-looking sha256 either.
• Unconditional git commit. Re-running for a version already in the tap failed on an empty index. It now exits cleanly.

A validation step runs ruby -c and brew style on each formula, checks the version stanza, and requires the exact set of checksums downloaded this run, which catches a substitution that silently no-ops.

Verification

test	result
bump all three formulae to a synthetic version	every url and checksum in the right place
brew style on the results	no offenses
replay the mlxcel-breaking layout (url, version, sha256)	url and sha256 updated, version untouched
replay the corrupted-file state	guards trip (version 0, sha256 2)
missing artifact	url guard trips
workflow YAML parse	OK, 8 steps

ruby -c alone is not sufficient: the corrupted mlxcel formula was valid Ruby and passes a syntax check. That is why brew style is in the validation step.

Related

• fix: edit tap formula stanzas by name instead of line position mlxcel#949 fixes the same construct in that repository, where it had already caused the breakage described above.
• lablup/backend.ai-go#3962 fixes stale cask and formula templates that were reverting hand-applied tap fixes.
• lablup/homebrew-tap 10facb2 repairs the damage in the tap.

lablup/all-smi has the identical positional construct and is not covered here.