> Instead, command-line executables could be given a specific tag, and the command-line would be able to execute any application that has that tag.

FWIW, plan9 allows you to control which portions of the filesystem are mounted into the visible namespace of a specific process.