One coordinator per runtime root still owns admission and receipt finalization. Register workers, probe them, then admit only when isolation and network are ENFORCED.
sovereign-agent fleet status --runtime-root ./runtime
sovereign-agent fleet worker list --runtime-root ./runtime
sovereign-agent fleet execution locate EXEC --runtime-root ./runtime
Pin container images by sha256: digest. Do not mount the engine socket into
an execution. Pin SSH UserKnownHostsFile; TOFU is refused. Inject secrets
only through SecretBroker at spawn. Disconnects are unknown until
fleet execution reconcile.