if there was a readonly base layer, and we encouraged folks to set writable destinations for caching (and we will), then we might not even need an explicit "mirror all the binaries" step. because as part of caching and remote execution, entries would end up in their mutable store