MXC Internals: How Microsoft's eXecution Containers Actually Isolate Agent Code