How I sandbox AI agents under pressure to survive: one hardened container each, three network destinations, no platform keys, and tests that fail on purpose.