Fix underlay provenance and resource path handling

internal/engine/resource_context_test.go

@@ -5,10 +5,46 @@ import (
 	"io/fs"
 	"os"
 	"path/filepath"
+	"runtime"
 	"testing"
 	"testing/fstest"
 )
 
+func TestResourceContextsPreserveLiteralBackslashes(t *testing.T) {
+	const directory = `assets\literal`
+	const name = directory + `/text\file`
+	check := func(t *testing.T, filesystem fs.FS) {
+		t.Helper()
+		data, err := fs.ReadFile(filesystem, name)
+		if err != nil || string(data) != "content" {
+			t.Fatalf("read = %q, %v", data, err)
+		}
+		entries, err := fs.ReadDir(filesystem, directory)
+		if err != nil || len(entries) != 1 || entries[0].Name() != `text\file` {
+			t.Fatalf("entries = %v, %v", entries, err)
+		}
+		if _, err := filesystem.Open("../outside"); !errors.Is(err, fs.ErrInvalid) {
+			t.Fatalf("escape = %v", err)
+		}
+	}
+	t.Run("native", func(t *testing.T) {
+		check(t, rootedNativeFS{filesystem: fstest.MapFS{"bundle/" + name: &fstest.MapFile{Data: []byte("content")}}, root: "bundle"})
+	})
+	t.Run("host", func(t *testing.T) {
+		if runtime.GOOS == "windows" {
+			t.Skip("backslash is a host separator on Windows; native case remains covered")
+		}
+		root := t.TempDir()
+		if err := os.Mkdir(filepath.Join(root, directory), 0o700); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filepath.Join(root, filepath.FromSlash(name)), []byte("content"), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		check(t, rootedHostFS{root: root})
+	})
+}
+
 type trackedHostRoot struct {
 	root     *os.Root
 	closed   *int