Command workerd-host runs stock workerd inside a gVisor/runsc sandbox via
clrk's extracted pkg/sandbox runtime. It is the artifact a lifecycle
controller (APO-796 ServiceManager) runs, and serves a worker's fetch handler
over an HTTP socket (M1 backend mode).