Sandboxing local models on macOS

Default-deny sandbox profiles for inference and agents, plus local Qwen3.5 and a QEMU VM.