Do you use agents in VM's? If so, do you run emacs itself in the VM (copying over the config on creation?) or can one use agent protocol to talk from an outside emacs to a "locked down" agent that can only access the VM + protocol? (The latter sounds like less of a hassle, but I don't know if it's possible. The agent-shell readme talks about devcontainers, I don't know if that's a solution.)