“Launch isolated Firecracker Minds from one workspace, governed by Keystone identity and Garden entitlements.”