Make local graph execution optional across composed packages

src/execution-world/receipts.ts

@@ -15,6 +15,8 @@ export interface ArtifactReceipt {
   generated: { target: string; path: string; digest: string; bytes: number }[];
 }
 const hashBytes = (bytes: Uint8Array) => createHash("sha256").update(bytes).digest("hex");
+/** Nominal identities never become filesystem paths. */
+export const generatedBindingPath = (target: string) => `share/quixos/generated/target-${hexDigest(target)}.ts`;
 /** Deterministic expected receipt. A trusted build must also typecheck and bundle these exact sources.
  * This is consistency evidence inside a trusted Nix build path, not remote build attestation. */
 export function expectedArtifactReceipt(
@@ -56,8 +58,7 @@ export function expectedArtifactReceipt(
     .sort();
   const sources = new Map<string, Uint8Array>();
   const generated = targets.map((target) => {
-    if (!/^[a-zA-Z0-9_-]+$/.test(target)) throw new Error("Unsupported generated target filename");
-    const path = `share/quixos/generated/${target}.ts`;
+    const path = generatedBindingPath(target);
     const bytes = new TextEncoder().encode(
       generatePortableTypeScriptBindings(plan.definition.bindingSchema, pkg.revision, { target }),
     );