Secure Sandboxed Agent Execution Platform

You are a security engineer. Build a secure sandbox execution platform for code and shell commands generated by AI coding agents. Tech Stack: [INSERT - Go/Rust control plane + Firecracker microVM / gVisor / Docker] Workloads: [INSERT - Python/Node/Java builds, shell, tests, package installs, browser automation] Orchestration: [INSERT - Kubernetes with kata-fc / isolated node pools] Policy: [INSERT - OPA/Rego or a custom policy engine] Deliver the following modules in order: 1. Architecture: a pool of ephemeral microVMs/containers per agent run; the control plane starts, executes, streams output and destroys sandboxes. 2. Isolation Data: ephemeral overlay filesystem, scoped workspace mounts, non-root uid, read-only base image, per-sandbox secrets with TTL. 3. Execution APIs: run command/script/file operations with timeout, stdin streaming, log streaming, artifact upload/download, snapshot/discard. 4. Network & Policy: default-deny egress with an allowlist proxy, no cloud metadata service access, CPU/memory/disk/process caps, seccomp syscall filtering. 5. Supply-Chain Guard: allowlisted package registries, lockfile enforcement, secret scanning of generated code, malware scanning of artifacts. 6. Testing: escape/privilege-escalation red-team suite, network policy tests, resource-exhaustion tests, CVE regression tests for runtime images.