mesh-build-node: run the type-check, the test script, tsc and esbuild in bubblewrap, so a change's code reaches no key, login or network (issue 1309, S1 S7 S8 S9, ADR 0448)

Each run step goes through mesh-sdk's buildstep.Isolated: no network, none of the account,
the workspace read-write, the toolchain read-only, the npm cache beneath a throwaway layer
unless the build step is told publish (a trunk build). The module declares the bubblewrap
package and refuses a step, unhealthy, while bwrap is missing or older than 0.10. The proof
test runs a probe script through the real test step.

modules/mesh-build-node/cmd/mesh-build-node/workspace.go

@@ -168,10 +168,16 @@ func copyFile(from, to string) error {
 	return out.Close()
 }
 
-// runIn runs a command with dir as its working directory (`env -C`), so it is the plain line the build agent runs from
-// the module's root, with the same relative paths. The command's environment is baseEnv and extra.
-func (m *Module) runIn(ctx context.Context, dir string, extra []string, name string, args ...string) forgekey.Ran {
-	return m.Run(ctx, append(m.baseEnv(), extra...), "env", append([]string{"-C", dir, name}, args...)...)
+// runIn runs a command of a run step shut off (stepRunner) with dir as its working directory (`env -C`), so it is the
+// plain line the build agent runs from the module's root, with the same relative paths. The command's environment is
+// a PATH, a locale and extra: never the account's HOME (the step's is its own) nor this process's environment. root is
+// the workspace; write is a trunk build's (publish), which alone writes the shared cache.
+func (m *Module) runIn(ctx context.Context, root string, write bool, dir string, extra []string, name string, args ...string) forgekey.Ran {
+	run, err := m.stepRunner(root, write)
+	if err != nil {
+		return forgekey.Ran{Status: 1, Err: err.Error()}
+	}
+	return run(ctx, extra, "env", append([]string{"-C", dir, name}, args...)...)
 }
 
 // ranFailed says why a command did not pass, or "" when it did.