[CoreyShupe]

Summary

• Support immutable authored machine PATH policy through NAKODE_MACHINE_PATH_READ_ONLY=1.
• Keep resolved paths in a private guest-local cache, discard parent-resolved fields, reject policy saves, and retain explicit guest Sync.
• Fail closed when inherited policy or startup resolution is invalid, and advertise MachinePathReadOnly on both listeners.
• Preserve ordinary standalone PATH behavior.

Validation

• Workspace formatting passes using the checksum-verified official Rust 1.97 formatter, matching CI.
• Focused real-source harness: 8 tests pass across this PATH module and FStack snapshot staging, with actual pinned SDK/server transport (not an auth stub).
• Independent static review found no actionable defects in the inspected inheritance paths.
• Full local all-target/all-feature test attempt blocked on an unavailable offline dependency (base64); local Clippy component unavailable. Required CI must establish these gates before merge.
• No live VM test or machine update performed.

Release coordination

After merge and successful immutable runtime-<SHA> publication, FStack will pin that exact release in both Cargo dependencies, its lockfile and enrollment release metadata. Machine updates remain owner-controlled.