the solution to both of these is the same thing. vps with accounts for all the services specific to the agent (github and whatever else)

That's actually a great idea! Easier to setup and use than VM (hello ssh), safer than docker, and still pretty cheap. Thank you for the idea!