Daemon-less OS security boundary & sandbox for AI coding agents (Codex, Claude Code, Cur…