MicroVM based sandboxes for agents, with container support, in a small independent binary installable from brew/winget