Egress allowlists and credential brokering in a microVM

Each experiment is one async function that creates a sandbox with one network policy, runs a Python probe inside it and returns an observation: step, expected, observed, pass. The sandboxes are all tagged, so the last experiment can find and stop anything left over. The decision that matters most is how brokering is checked. The token appears in the network policy and nowhere else, and the check looks for it in the environment, in common credential files and in /proc/self/environ. It also confirms the header arrived at a server you control, so "the header was injected" and "the code couldn't see it" are both observed, not assumed.