A Docker Agent release gate, its guardrails tested against the real runtime with a Go stub model, and one permission pattern that let a denied command through.