Most agent setups assign one machine to the whole session. But each step has different needs: builds need microVMs, verification needs a browser, and untrusted code needs an isolated, throwaway function.
Provision compute per step, shut it down once completed.
It can be done, with proper boundaries.