A Go rebuild of Google's Agent Compute Engine pattern on Firecracker: copy-on-write snapshot forks, idle-aware hibernation and a NIC-less guest with a credential-injecting proxy, measured on bare metal and under nested virtualization.