pub fn check(directory: &Path) -> Result<PathBuf, Box<dyn Error>>Expand description
Admit an existing reviewed bundle without downloading or changing it.
Authenticates the bounded archive before decoding, compares the executable’s
exact bytes, then runs bounded --version admission with an empty environment.
Returns the absolute executable path, not ongoing custody of its namespace.
Callers must prevent replacement between admission and managed startup.
§Errors
Rejects unsupported hosts, redirected paths, missing or modified bundles, invalid archives, or failed executable/version admission.