Materialise spec for the Node host. Image mounts get a fresh,
cryptographically verified MemoryFileSystem; scratch mounts get a
HostFileSystem rooted at <sessionDir><spec.path> (the directory is
created with mkdirSync({recursive:true}) so safePath is happy on first
access).
Asynchronous input → output function with no global state.
Materialise
specfor the Node host. Image mounts get a fresh, cryptographically verifiedMemoryFileSystem; scratch mounts get aHostFileSystemrooted at<sessionDir><spec.path>(the directory is created withmkdirSync({recursive:true})sosafePathis happy on first access).Asynchronous input → output function with no global state.