VESS local AI agent runtime — manages agent identity, permissions, and execution boundaries