What

• Add a focused regression test proving Kernel.mountFs routes reads and writes through a plain JavaScript VFS object.
• Make the V8 bridge build resolve pinned shim dependencies from secure-exec before a caller workspace.

Why

When secure-exec is consumed from a sibling workspace, the V8 bridge build could resolve web-streams-polyfill from the caller workspace instead of secure-exec's pinned dependency. That broke Agent OS local secure-exec builds when the caller had web-streams-polyfill v4 installed.

Validation

• pnpm --dir packages/core exec vitest run tests/mount-fs-custom-vfs.test.ts --reporter=verbose