Node 24, and a permission model I still did not enable

A runtime permission model re-evaluated a year after the first look, with the same conclusion for the same reason.

$ node --permission 
    --allow-fs-read=./src --allow-fs-write=./dist 
    --allow-child-process 
    build.mjs

# and --allow-child-process permits everything the
# child does, which is the whole filesystem.

# the flag list still ends up permitting most of what
# it was meant to restrict.

Re-running an evaluation and reaching the same conclusion is worth the twenty minutes because the conclusion could have changed and did not. The build genuinely needs to shell out, and a sandbox opened far enough for the workload documents the workload rather than constraining it.