feat(sandbox): guest-native /opt/agentos granular tar mounts

[NathanFlurry]

• Serve /opt/agentos packages directly from their package.tar via a new tar-backed read-only VFS (mmap + digest-keyed index, no extraction, no on-disk staging).
• Compose /opt/agentos from granular leaf mounts: one tar mount per pkgs/<pkg>/<version>, one in-memory single-symlink mount per bin/<cmd> and per pkgs/<pkg>/current; parent dirs stay writable overlay dirs so user installs coexist with managed ones.
• Rework MountTable::realpath to resolve symlinks across mounts (delegating to a mount's own realpath for single-mount paths, walking components only for genuine cross-mount chains).
• Make kernel exec follow cross-mount symlinks before reading the shebang, classify extensionless agentOS bin/<cmd> launchers as JavaScript, and skip host→guest shadow sync for read-only guest-native package mounts.
• Emit 0755 on bin/<cmd> targets at pack time in the toolchain (npm ships 0644).
• Remove the extract-to-staging step and the physical symlink farm from package projection.

Known follow-ups (not addressed here)

• MountTable::realpath cross-mount walk resolves mount-internal symlinks with VM-root semantics (absolute targets / ..) — a confinement divergence; not guest-reachable today (walked mounts are read-only) but should be confined to the mount root.
• realpath of a path under a single-symlink mount returns ENOENT (delegation only falls back to the walk on ELOOP); latent, not hit by current callers.
• TarFileSystem drops hardlink members and can shadow a synthesized parent dir on a malformed tar; SIGBUS-safety of the mmap is an operational immutability contract, not enforced.
• MemoryFileSystem::write_file_with_mode silently ignores its mode argument.

This branch also carries in-progress sandbox-multiline-prompt work beyond the tar-mount change (registry/software updates, doc cleanup).

[railway-app]

🚅 Environment secure-exec-pr-276 in rivet-frontend has no services deployed.

---

🚅 Deployed to the secure-exec-pr-276 environment in secure-exec

Service	Status	Web	Updated (UTC)
secure-exec	😴 Sleeping (View Logs)	Web	Jul 6, 2026 at 2:08 am