Local-first agent governance: keeping an AI agent contained | Dark Hacker News