Wasm guests (wasm32), built outside the host workspace. Heimdall is a defensive sandbox.
- verify-bundle: Holger's update bundles (spec §9, milestone 1).
- static-scan: the static-scanner guest (behavior, typosquat, dependency confusion, registry, malicious feed) on modgunn's code; contract in crates/heimdall-scan and docs/API.md, "Static-scanner guests".