> I might want my code to dabble in CORS, read env vars, or snoop around in my .ssh directory, but I don't want my imports to be able to do that.

OpenBSD has a (partial?) solution for that: pledge (2)

https://man.openbsd.org/OpenBSD-6.7/pledge.2

Often, a programming needs a lot of rights at the start to set things up (often even root permissions). After this has been done, it should better have irrevocable limited rights. The pledge() syscall is there to do this transition:

"Subsequent calls to pledge() can reduce the abilities further, but abilities can never be regained."