Ephemeral Hetzner Workers for Agent Isolation

anonymous shared a canary architecture where Goliath acts as a persistent orchestrator that provisions fresh Hetzner CCX VMs per agent run, bootstraps scoped access, collects evidence, then destroys the VM. The sandbox b…