Plan → dispatch → disposable Docker sandbox → verifiable receipt.
network=none
memory=512m
cpus=0.5
pids=64
secrets_passed=false
docker --rm