Module sandbox 

Cross-platform sandbox helpers shared by every runtime.

For now this is just a timeout primitive — with_timeout spawns the work on a worker thread and gives the caller back an ExecError::Timeout if the channel doesn’t deliver in time. The worker thread is not joined: if it overruns, it keeps running until it finishes or the process exits. That’s a known leak for runtimes without cooperative cancellation (the toy Lisp). The wasmtime backends coming in M2 cancel cooperatively via wasmtime::Engine::increment_epoch, so they’ll route through the same helper without the leak.

Functions

with_timeout

Run work on a worker thread; return its result or Err(ExecError::Timeout) if it doesn’t finish within timeout.