Use-case page: untrusted code execution as a security primitive

[stubbi]

Context

"Run any untrusted code with hardware isolation" is the original sandbox job and a strong positioning beat. The market ranks isolation depth Firecracker microVM > gVisor > container; Daytona's default is a container. The CrewAI sandbox-escape CVE story (DIY sandboxes get CVEs) is the cautionary tale.

Deliverable

• A page: "do not roll your own sandbox, it gets CVEs; self-host hardened Firecracker microVMs."
• The microVM-by-default wedge stated plainly, with the isolation-depth comparison.
• Default-deny egress, no silent secret inheritance, per-session kernel.

Links

• Complements the existing security/isolation messaging work (website Messaging: make security/isolation a first-class pillar (without losing the fork/swarm lead) #27, closed) without losing the fork lead.
• Part of the use-cases hub (C1).

Done when

• Page is live with the security framing and the isolation-depth comparison.