Ephemeral Hetzner Workers for Agent Isolation

@sav310 shared a canary architecture where Goliath acts as a persistent orchestrator that provisions fresh Hetzner CCX VMs per agent run, bootstraps scoped access, collects evidence, then destroys the VM. The sandbox bou…