Containment beats permission

Coding agents should run unsupervised, but inside a dev environment that's safe to be wrong in. The agent boundary is the wrong line to defend.