Releases the workspace.
Must be safe to call on every exit path including crash and cancellation, and must not throw — a finalize that throws inside a failure path masks the original error with a cleanup error.
Provisions (or reattaches to) the workspace identified by key.
Provisions and finalizes the filesystem a harness runs against.
Kept deliberately small — two methods — because the interesting variation between a local directory and a container is not the shape of the API, it is what
NetworkPolicycan actually enforce. The local provider can only honour it on a best-effort basis; a container provider enforces it for real, which is whymcp-onlyis the recommended production posture and only meaningful there.