Open-source agent runtime — SSH-native isolation, eBPF egress policy, Kubernetes + LXC b…