1. A method comprising: obtaining, at a compiler toolchain, application code for an application to be implemented; accessing, with said compiler toolchain, a package manager which tracks dependencies for a set of software components represented as a corresponding set of packages, said set of software components comprising application-level components represented as application-level packages, hypervisor interface-level components represented as hypervisor interface-level packages, and hypervisor-level components represented as hypervisor-level packages, said dependencies being specified as metadata of said set of packages; employing a dependency solver of said package manager to select a sub-set of said set of packages that satisfy corresponding ones of said dependencies based on references to given ones of said packages in said application and corresponding metadata in each of said given ones of said packages; and with said compiler toolchain, assembling said sub-set of packages into an executable bundle to implement said application, said executable bundle comprising: a statically-linked binary built entirely from said sub-set of said selected packages that contains no external dependencies except calls to an interface defined entirely by said hypervisor interface-level packages, and a specialized monitor built entirely from said sub-set of the selected packages that runs on a standard operating system, loads and executes said statically-linked binary, and interacts with said statically-linked binary only through said interface defined by said hypervisor interface-level packages.