fix: remove personal username from fs-guard HOOK.md example

feat: bwrap sandbox + fs-guard hooks + vault setup + pentest script

security: docs overhaul — bwrap recommended, docker removed, agent-first

feat: secure.sh — one-command exec sandbox setup

docs: docker sandbox phase 2 — non-main mode recommended

docs: add self-escalation findings + chattr/watchdog defense

docs: exec sandbox — agents.main fix + approval buttons step + compact json

docs: exec sandbox — agents.main gotcha + inline approval buttons guide

openclaw-infra: infrastructure starter for personal AI assistants