Nono: A secure, kernel-enforced capability sandbox for AI agents | Hacker News Reader