Should take an FD to the executable

I tend to agree with this - but should that be restricted to only O_PATH fds referencing existing files on disk, or could one also consider e.g. a memfd (possibly requiring it to be sealed) where e.g. a JIT previously put the result of a run-time compilation? The latter could be quite useful in some circumstances (but also quite useful for hiding malware in non-obvious ways, so YMMV).