Function contain_trap 

pub fn contain_trap(op: &str, guest_path: &str, err: &ContainError) -> Error

The single translation from a containment failure to a guest-visible trap. Every escape reaches the guest as the same diagnostic regardless of which operation hit it, so an LLM reading one recognises the rest.

A read-only refusal that got past [require_writable] still surfaces as a PermissionDeniedError, attributed to <vfs> since the caller is not at hand.