Integrate routed Git workspaces with persistent state

crates/lazaret-runtime-supervisor/src/sandbox.rs

@@ -625,6 +625,25 @@ pub fn production_sandbox_layout() -> Result<SandboxLayoutV1, SandboxBuildError>
 /// Refuses changed host authority, namespace mismatch, invalid paths, or encoding failures.
 pub fn build_sandbox_bundle(
     request: SandboxBuildRequest<'_>,
+) -> Result<SandboxBundle, SandboxBuildError> {
+    let workspace_source = host_path(request.configuration.workspace().canonical_label())?;
+    build_sandbox_bundle_from_source(request, workspace_source)
+}
+
+/// Builds deterministic OCI bytes using a generation-local routed workspace source.
+///
+/// # Errors
+/// Refuses an invalid source, changed host authority, namespace mismatch, or encoding failure.
+pub fn build_sandbox_bundle_with_workspace(
+    request: SandboxBuildRequest<'_>,
+    workspace_source: PathBuf,
+) -> Result<SandboxBundle, SandboxBuildError> {
+    build_sandbox_bundle_from_source(request, workspace_source)
+}
+
+fn build_sandbox_bundle_from_source(
+    request: SandboxBuildRequest<'_>,
+    workspace_source: PathBuf,
 ) -> Result<SandboxBundle, SandboxBuildError> {
     require_network_namespace(request.expected_network_namespace)?;
     request
@@ -648,6 +667,7 @@ pub fn build_sandbox_bundle(
         request.configuration,
         request.terminal.as_ref(),
         &paths.control_sources,
+        workspace_source,
     )?;
     let process = build_process(
         request.configuration,
@@ -873,10 +893,11 @@ fn build_mounts(
     configuration: &ResolvedDomainConfiguration,
     terminal: Option<&StagedHostTerminal>,
     control_sources: &Path,
+    workspace_source: PathBuf,
 ) -> Result<Vec<Mount>, SandboxBuildError> {
     let mut mounts = standard_mounts()?;
     mounts.push(bind_mount(
-        host_path(configuration.workspace().canonical_label())?,
+        workspace_source,
         PathBuf::from(WORKSPACE_DESTINATION),
         false,
         false,