Admit checked restricted artifacts without individual code approvals

restricted-execution/default.nix

@@ -20,6 +20,17 @@ let
     runtime = nativeProbe;
     executable = "${nativeProbe}/bin/probe";
   };
+  identityLauncher =
+    pkgs.runCommand "quixos-restricted-identity-launcher"
+      {
+        nativeBuildInputs = [ pkgs.stdenv.cc ];
+      }
+      ''
+        mkdir -p "$out/bin"
+        $CC -O2 -Wall -Wextra -Werror ${./identity-launcher.c} \
+          -DSANDBOX_EXECUTABLE='"${sandbox}/bin/quixos-restricted-sandbox"' \
+          -o "$out/bin/quixos-restricted-engine"
+      '';
   # Transaction-port/value adapters do not need the browser's CRDT/Wasm engine.
   # Keep this surface explicit; it is bundled into checked restricted handlers.
   sdk = pkgs.runCommand "quixos-restricted-sdk" { nativeBuildInputs = [ pkgs.esbuild ]; } ''
@@ -61,6 +72,7 @@ in
   inherit
     workerd
     sandbox
+    identityLauncher
     nativeProbeSandbox
     sdk
     runtime