Restore one immutable shell image into a private filesystem, then fetch,
verify, preflight, and register independently selected Homebrew runtime
layers. The filesystem is published to the caller only after every selected
layer and boot-prefetch tree succeeds, so allocation, collision, and fetch
failures cannot expose a partial namespace. Descriptor bytes are eager and
bounded; first-use deferred-tree bytes remain lazy.
Restore one immutable shell image into a private filesystem, then fetch, verify, preflight, and register independently selected Homebrew runtime layers. The filesystem is published to the caller only after every selected layer and boot-prefetch tree succeeds, so allocation, collision, and fetch failures cannot expose a partial namespace. Descriptor bytes are eager and bounded; first-use deferred-tree bytes remain lazy.