Run picoclaw securely in an isolated NetBSD microVM. Minimal footprint, strong isolation, sub-second startup.