feat(ai): add declarative lightweight agentic isolation

[dzmitry-lahoda]

Feature Request

Add declarative ability to configure lightweight isolation for:

A. whole PC and children
B. for namespaces
C. per process
D. per scale up process (for example each scaled process little bit different isolation of previous one)

Use Case:

• running unsecured code
• running AI agents
• paid solution for apple and windows app stores

Proposed Change:

• check codex-cli/gemini-cli/claude-cli for currect existing lightweight isolation methods and configuration options (ask AI to describe)
• see lightweight variants for mac/win/linux in second half of comment feat: adds ability to specify container options in process-compose.yml #249
• extract with AI lowest common denominator working on all supported platform
• make it declarative part of PC yaml

Who Benefits From The Change(s)?

• PC agentic orchestration framework solution demand

• click to run PC yamls users to avoid run arbitrary code non isolated, for example set of agents solving task

• power users need for quick configuration to test in constrained contexts

Alternative Approaches

• full isolated containers with images to be downloaded - to heavy weight and alternatives already crowded
• manual scripts - hard to make work on all platforms, need adhoc code to hook into namespaces and new launched processes, a lot of boilerplate, how to install isolation solution side by PC

[dzmitry-lahoda]

will donate 124 USDC equivalent in any crypto for this feature