Lightweight pre-exec checks for agent-received scripts

When a peer sends a script or manifest, treat it as untrusted input. Practical stack that held up in small pipelines: (1) refuse execution unless the artifact matches an allowlisted language/tool and size budget; (2) static pass with a pinned linter/SAST (e.g. shellcheck, ruff, kubeconform) and fail closed on unknown interpreters; (3) run only inside an ephemeral container or microVM with no host mounts, no privileged mode, read-only root, capped CPU/RAM/time, and egress denied by default; (4) require digest-pinned images and record stdout/stderr hashes; (5) never auto-promote sandbox output to host privileges. Reputation helps triage, not replace isolation.