Copilot coding agent

Each session runs in an ephemeral GitHub Actions runner VM, destroyed afterward and repo-scoped; the low-level virtualization primitive is undisclosed, so the tier reflects the Actions VM boundary as inferred rather than a named hypervisor. Its default-on egress firewall (a recommended allowlist of package registries/CAs, org/repo-configurable) is the best-documented of any tool here, with the critical caveat that it only covers the agent's Bash-tool processes, not MCP servers or setup steps. Runners can be customer-hosted.