What are the structural limits of AI containment?