fix(homebrew-build-bottles): override HOMEBREW_REQUIRE_TAP_TRUST at step env level

In-script `unset` (v1.8.57) didn't take effect: GitHub-hosted runners
seed HOMEBREW_REQUIRE_TAP_TRUST=1 in `/etc/environment`, which child
processes (brew → Ruby) re-inherit despite the bash unset in the parent
shell. The trust check inside `brew install --build-bottle` therefore
kept firing on alef v0.24.10 / kreuzcrawl rc.55 publish reruns.

Setting the variable to an empty string in the action.yml step `env:`
block hardens the override: GHA exports the empty value to the shell
and to every process it spawns, including brew's Ruby interpreter,
where `Homebrew::EnvConfig::EnvConfigBool#truthy?` treats "" as falsy
and the tap-trust check is skipped. Also lift HOMEBREW_NO_INSTALL_FROM_API
and HOMEBREW_NO_SANDBOX_LINUX to the step env: for symmetry — the
in-script exports remain as defense-in-depth.

Author: Goldziher

homebrew-build-bottles/action.yml

@@ -47,4 +47,17 @@ runs:
         FORMULAS: ${{ inputs.formulas }}
         OUT_DIR: ${{ inputs.out-dir }}
         GITHUB_REPO: ${{ inputs.github-repo }}
+        # GitHub-hosted runner images export HOMEBREW_REQUIRE_TAP_TRUST=1
+        # in /etc/environment, so child processes (brew → Ruby) inherit it
+        # even after an in-script `unset`. Setting it to empty at the step
+        # env: level overrides the inherited value for every process spawned
+        # by this shell, including brew's Ruby interpreter. EnvConfigBool's
+        # `truthy?` check treats "" as falsy, so the tap-trust check passes.
+        HOMEBREW_REQUIRE_TAP_TRUST: ""
+        # Also force git-tap installs so the formula is read from the
+        # just-tapped clone instead of the JSON API.
+        HOMEBREW_NO_INSTALL_FROM_API: "1"
+        # Disable Homebrew's Linux sandbox (bubblewrap cannot create a
+        # rootless sandbox on GitHub-hosted Linux runners).
+        HOMEBREW_NO_SANDBOX_LINUX: "1"
       run: "${{ github.action_path }}/scripts/build-bottles.sh"