Sandbox and capabilities

KOB3 apps run in a deny-by-default WASI sandbox. The host grants only the capabilities your app needs: layout, fill, pointer handling, viewports, and so on.

Use constants from koba_wasi_sdk::caps when setting properties on nodes. See Capabilities and the reference.