Jenkins Agent Hardening

A fork pull request opened a network path from a shared Jenkins agent to an internal metadata endpoint

One team's audit found a single pool labelled linux-docker scheduling outside contributors' builds onto the same agents that held internal deploy credentials, an arrangement that sat outside anything a controller permission model was built to check.