Function check_export_root 

pub fn check_export_root(
    accessible_workdir: &Path,
    export: &FileExport,
) -> Result<(), RuntimeError>

Refuses a launch whose declared export root already resolves outside the accessible workdir.

Called from stage_session before the workdir is created, so a capsule whose out/ is a symlink into someone else’s directory never runs at all — the alternative is discovering it one served file at a time, by which point the first file has left. A root that does not yet exist is accepted: the agent may create it during a task, and every request resolves the root afresh.