[feature] add support for running in a VM

### Component

cross-cutting / not sure

### Problem / motivation

I would love to run this on a idle Mac but `curl | bash`-ing an opaque binary is scary. Would be great if this can be served a least privilege VM that does not need access to any of the host file system.

### Proposed solution

Use some sort of VM to run the binary.

### Alternatives considered

_No response_

### Scope notes

_No response_

The issue names no files, tests, or entry points. Start by surveying how the Go binary is built and launched on Macs, then define the VM approach and its host-isolation requirements. Done should mean the project runs in a least-privilege VM without host file-system access.

Written by the indexing model from the issue text.