always-further/nono

Kernel-enforced agent sandbox. Capability-based isolation w…