It's funny how easy Plan 9 would make all this. Just mount the work dir as readonly in Cowork's filesystem namespace and mount a write-only dir for output.

We can still do this via containers, though. But it does have some friction.