workstead

workstead provisions and manages a dev sandbox: a dev box that reaches the
network only through a gateway instance, both LXD instances it creates. It
is the host-side CLI and, inside the gateway, the egress payload (iron-proxy,
gitproxy, dnsmasq, secretsfs). It is not the sandbox itself, and it does not
install or configure coding agents.