🧰 feat: Share Explicit Environment Tool Resources

[danny-avila]

Summary

Worktree-local package caches and browser downloads multiply storage even when tasks use identical tools. Add explicit per-environment stores for npm/uv downloads and Playwright browser binaries, without granting a broad parent directory or sharing mutable installations.

Mechanism

Operator YAML declares each known resource kind, absolute existing directory and read-only/read-write access. The worker loads private inode-bound roots, rejects overlap with every workspace/control path including Linux mount aliases, and forwards only that environment's grants through native executor IPC. Root commands, linked lanes and conversation instances receive fixed cache variables from the loaded definition.

Native SRT grants precisely those resource roots. Browser profiles, service data and build output remain checkout-local. Read-only resources stay read-only; speculative programmatic probes may read resources but cannot write them. Replacing a resource root rejects commands before dispatch, with mutation-atomic diagnostics rather than an unnecessary quarantine.

This is stack slice 2, based on #286. It shares downloads and browser binaries, not installed dependency trees, and does not yet add eviction or quotas. Configuration and trust-domain limitations are documented in the worker README. Nothing changed on a live worker.

Verification

• Worker TypeScript build.
• 55 focused environment, preparation, real CLI and native-process tests passed, including real SRT preparation/resource tests.
• Real resource canary: two simultaneous independent checkouts share the same declared store; browser writes and sibling-checkout reads are refused.
• Additional pre-dispatch cache-replacement regression.
• git diff --check.

A broader native-sandbox unit run also exposed an existing macOS /var alias fixture failure; it reproduces unchanged on the parent of this slice. Existing FileHandle GC warnings also remain outside this change. Broad cross-platform coverage is left to CI.