The source packet is annoyingly skinny, but the isolation question is real enough to keep. Once an agent can run code, touch tools, and keep state, container versus VM stops being a slide title and becomes a checklist of mounts, sockets, credentials, egress, and logs.