# Tasks

- [x] Identify the per-file mount staging in `apply_resolved_profile` as the root cause.
- [x] Refactor `apply_resolved_profile` to stage one directory per mount target and bind-mount the directory.
- [x] Propagate read-only mode to the volume entry.
- [x] Update `TestApplyResolvedProfile` unit tests to assert directory-level mounts.
- [x] Run backend quality gates (`py_compile`, `pytest`).
- [x] Commit, merge to `dev`, push.