📦 feat: Restore Isolated Dependency Snapshots

[danny-avila]

Summary

Fresh coding checkouts currently repeat installation and allocate a full mutable dependency tree even when their declared install inputs match. Add an opt-in private copy-on-write snapshot store to environment preparation. Existing definitions and existing installations retain their behavior.

Mechanism

declared inputs + recipe + project + policy + toolchain
                      │
                portable key lock
                      │
       missing installation ── snapshot exists
                      │               │
                 sandbox setup    isolated reflink restore
                      └──── readiness + unchanged inputs ────┐
                                                   checkout receipt

• Keep the store outside source, credentials and granted tool caches, denied to native commands.
• Preserve relative checkout-local package links; reject escaping links, special files and bounded traversal overflows. Descriptor-anchored access and exclusive rename prevent replacement of existing destinations.
• Publish only a complete snapshot. Require actual filesystem clones, never writable hardlinks or a full-copy fallback. Unsupported or cross-filesystem configurations fail before setup.
• Serialize one fingerprint with kernel locks, leaving other fingerprints independent. Revalidate the store after waiting.

This is stacked on #287. It handles startup and fresh managed conversation preparation, not automatic installation in manually created linked lanes, Python virtualenv relocation, arbitrary shell-write quotas or garbage collection. Ordinary ext4 deployments should leave this option disabled.

Verification

• Worker TypeScript build passed.
• Focused preparation, environment, storage, root-access and real CLI checks: 63 passed, 4 platform-fixture skips.
• Included real APFS cloning and native-SRT canaries: separate file inodes, write isolation, preserved local links, changed lockfile invalidation, skipped second setup and denied store access.
• git diff --check passed.

Live workers and deployments are unchanged. Linux reflink integration requires a clone-capable volume and the explicit live-snapshot test flag; it was not exercised locally on this Mac.