Function derive_pinned_programs 

pub fn derive_pinned_programs(
    tools: &[DeclaredToolDownloads],
    shell_allow: &[String],
) -> Vec<ResolvedPinnedProgram>

The source of each program tools pin a download of for this host, for the programs shell_allow grants, against mur’s own PATH and ~/.murmur/programs.

Reads only, never fetches, never fails: a program the store holds no copy of is PinnedSource::Missing.