What about using CoW file system snapshots and then mounting it on overlayfs as the lowerdir while having the agent's working directory be the upper directory? I wonder how the agent reacts to finding some files being immutable.