vCluster isolation: where the syncer stops

A vCluster gives a tenant its own API server, CRDs and RBAC, and for a while that feels like the whole answer. Then someone in security asks a plainer question: _where do their pods actually run?_