Start the agent, and fence it in

The Copilot CLI is driven as a subprocess, pointed at the native executable the
lockfile pins rather than the bundled JavaScript entry. Left to itself the SDK
spawns `node` to run that entry — under Bun, the literal string "node" — and
this machine does not have one. Resolving the platform build removes the
runtime from the equation and makes the CLI version a lockfile decision.

Boot proves the whole chain by starting a session, selecting the planner and
throwing it away: binary, token and entitlement, in about six seconds. A stale
token is the likeliest failure and the only way to detect it is to ask, so it
is asked at startup rather than discovered by whoever types first.

The permission gate is the whole boundary. Ace can afford a permissive one
because its agent runs in a microVM; this runs as you, on your filesystem, so
the gate is an allowlist. Writes are refused rather than confined — a planner
has no business writing anything, and the plan it does write goes through a
tool that validates every byte. Reads are confined to the working directory and
refused for credentials within it. Shell commands must be ones the runtime
itself classifies as read-only. Anything unrecognised is denied, because an
unrecognised capability is one nobody has reasoned about.

The dependency singleton check now asserts the property rather than the layout.
It counted store directories, and adding the Copilot packages produced a second
Lexical directory that nothing loads — a false alarm for a real hazard. It now
constructs a node through MDXEditor's visitors and checks our own type guard
recognises it, which is the failure itself rather than a proxy for it.