isolated-worker-execution

The execution boundary is not ready: inherited supervisor environment, a mounted home directory, external network access, and job-requested capabilities expose secrets and weaken isolation. Enforce environment and filesystem isolation, disable networking, and reject capabilities, alongside syscall and resource limits. Validate these controls using harmless local canary and policy checks without executing the submitted build or contacting external services. Severity is high for untrusted builds until these controls are enforced.