[rami-hatoum]

What this changes

Six small seams a program that composes the core outside the server needs, each on its own terms.

• The sandbox's module is given as bytes or already compiled. The engine compiled its WebAssembly from bytes it read itself; an instance source now takes a SandboxModule, bytes to compile once or a module a host compiled, and a pool worker reads its handed bytes only when its first unit asks.
• A stdio server's transport loads with the first one opened, as the MCP client already does, so a server that configures none never loads it.
• A shipped file is named by its package and its path within it, { package, path }, rather than by a URL computed from a module's address at load, which collapses when modules are bundled together. Each package declares its roots once and exports them; a third-party file, the engine's WebAssembly and the compiler's lib, is named under its dependency at the root the dependent resolves; the served documentation is docs of the root package; the server builds the map of roots in one place and the disk reader resolves nothing itself.
• Encoding and byte APIs are explicit where a choice is open, at ten sites: the decoder options both named, a worker started from a URL, a file handle opened on first read, and the rest the commit message names, each the smallest form two type sets accept.
• Exports a shell needs: the secret rows on SQLite, the check handler on its own subpath so no other entry reaches the compiler, the ledger's behaviour suite with its entry type from the ledger's testing entry, and the SQLite parts of the suite's entry over a caller's executor, none of which loads a driver.

Tests

• A pre-compiled module and a late read of the handed bytes; the stdio transport not reached from the linked access; every shipped file read through the port with no URL computed at load; the exported parts opened on sqlite3 by the ledger's own tests, with the sqlite3 entry still the only module that loads the driver.
• pnpm check passes on each commit, cold.