Support a fail-closed mount-free transport for local-code Docker scans

Problem

Strix v1.5.3 represents local_code and workspace_mount inputs as the user's real directory mounted live and writable. This is explicit in strix/core/inputs.py, and the Docker path currently depends on a host bind mount.

That prevents consumers with a policy that prohibits host mounts from using local-code scans without weakening their boundary. Copying a repository to a temporary host directory does not solve the issue—the temporary directory is still bind-mounted writable into the scan container.

Requested capability

Please add a mount-free local-code transport for Docker scans, such as an immutable archive/upload or a copy into an isolated container volume, together with an explicit mode that:

• guarantees no host path is bind-mounted into the scan container;
• makes the supplied snapshot available under the normal workspace path;
• fails closed before scanning when mount-free transport is unavailable;
• reports the transport used in machine-readable run metadata; and
• documents snapshot mutability, cleanup, and trust boundaries.

This should be an opt-in capability; existing workflows do not need to change.

Acceptance

• A local-code scan can complete with Docker inspection showing no host bind mounts.
• The scan operates on a bounded snapshot rather than the caller's live directory.
• An explicit require mount-free mode exits non-zero before scan execution if the guarantee cannot be met.
• Workspace path behavior is documented for agents and tools.
• Automated coverage verifies both the mount-free success path and fail-closed refusal.

Motivation

Security orchestration tools need to distinguish a writable host mount from a contained snapshot. A first-class mount-free transport would let callers enforce that distinction instead of inferring it from backend behavior.

Source checked

• Strix v1.5.3
• strix/core/inputs.py (local_code / workspace_mount descriptions)

No request is being made to weaken Strix's existing sandbox or to expose live/remote targets by default.