docs: rename README title to AI CLI

feat: sync harness with sandbox — engram, ralph, kilo, opencode, wt

Updated the README.md so it was more informative.

Migrate to global harness layout and bootstrap flow

Modified the memory system and the mem plugin.

fix: remove global IFS in init-firewall.sh to satisfy semgrep ifs-tampering rule

Ensure venv is auto-activated idempotently and document Python venv

Added semgrep for using to spot bugs and security flaws in code.

docs: comprehensive README with security guidance and dual sandbox modes

Initial commit: AI CLI sandbox Docker environment

Initial commit