Agent infrastructure boundary

Agent code, filesystem contents, and network egress must never leave infrastructure controlled by the operator. Vendor-managed execution may look simpler, but it violates the required security boundary unless the vendor only provides control-plane routing and the actual agent runtime and egress remain inside controlled infrastructure.