Local sandboxing in Kiro: keep agent commands within boundaries | EngBrief