If you have a VM that processes opcodes and has no way of (a) adding opcodes to the end or (b) moving backwards in the stream, it won't be Turing complete.

I've used a scripting system for a server that was intentionally written this way to bound the harm a misbehaving script could have on the server.

RE2 is also designed along these lines https://swtch.com/~rsc/regexp/regexp3.html