Function ensure_mutation_workspace_safe 

fn ensure_mutation_workspace_safe(config: &Config) -> Result<()>

Bails if mutation testing could corrupt the real dependency trees.

The mutation runner symlinks dependency directories (lib, node_modules, dependencies) into each per-mutant TempDir for performance (see workspace::copy_project). That isolation breaks down if tests can write to those shared trees, either via vm.writeFile (broad fs_permissions) or arbitrary ffi calls.