An untrusted pull request can run build code. Why should its jobs not use a privileged persistent deployment agent without isolation?

1. Self-hosted agents cannot execute tests
2. The agent's hostname would be too long
3. All pull requests automatically have production authorization
4. Build code could access agent credentials or persist changes affecting later jobs