Agent sandboxing

Isolated, permission-scoped execution environments (containers, microVMs like Firecracker/gVisor) so an agent's tool calls and code execution cannot harm the host.