DL-024

Each agent runs in a per-agent container on the Runner for blast-radius isolation, not credential avoidance

Status: Active (Matt, 2026-07-06)

Record: ../../meta/compass-architecture-lineage/design.md