The scratch runtime stage copies an explicit /tmp: restore extracts an archive there before verifying it, and a scratch image has none. shared/ now fans out to four Go images rather than three.
