Make local package overlays consumable by manager-run services

[adrianwebb]

Objective

Allow manager-owned development containers to consume package overlays generated by an unprivileged checkout without weakening source or secret custody.

Acceptance

• Overlay path generations are group-traversable for the checkout group.
• Overlay contents remain non-public.
• Manager-side API startup resolves local SDK dependencies.
• Automated coverage verifies directory custody.
• No package publication is required.