Sandvault: Run AI agents isolated in a sandboxed macOS user account | Heykuki News