Tangentially, in theory, k3s + kubevirt + microvms sounds like the optimal combination for lightweight but isolated deployment. Does anyone have experience with that?

KubeVirt only supports full QEMU. They have a long open issue about QEMU MicroVM support.

I think you might be looking for Kata Containers which is a CRI for running vmms like firecracker.