dredozubov/hazmat

macOS containment for AI agents — user isolation, kernel sa…