Capturing this so it's not lost in a closed PR.
As @itowlson rightly points out here, the deny-all adapter (used to enforce configuration inheritance for component dependencies) is built AOT and included in-tree as a binary blob. Is there a better solution to this?