Composable agent runtime with enforced isolation boundaries