Unify host and native filesystem acquisition

internal/engine/source_file.go

@@ -4,7 +4,6 @@ import (
 	"errors"
 	"io"
 	"io/fs"
-	"os"
 )
 
 type sourceReadFailureKind uint8
@@ -26,7 +25,7 @@ type sourceReadFailure struct {
 // readRegularFile borrows stat/open operations so root-bound callers retain their
 // containment policy. Preflight rejects FIFOs before open can block. The opened
 // handle is checked again and always closed; read-only close errors are ignored.
-func readRegularFile(name string, stat func(string) (fs.FileInfo, error), open func(string) (*os.File, error), limit int64) ([]byte, *sourceReadFailure) {
+func readRegularFile[F fs.File](name string, stat func(string) (fs.FileInfo, error), open func(string) (F, error), limit int64) ([]byte, *sourceReadFailure) {
 	info, err := stat(name)
 	if err != nil {
 		return nil, &sourceReadFailure{cause: err, missingTarget: errors.Is(err, fs.ErrNotExist)}