lembas -l / --local: everything in the project, nothing written elsewhere

Config, data and state are rooted at <project>/.agent/local/lembas (or
.lembas/), kept out of git; a local directory the repository carries is
refused. The user's logins and connections.yaml are read, never written; the
user's config.yaml is not read. The TUI is started with TMPDIR inside it (the
compiled binary unpacks its native library there) and OpenTUI's cache goes
there too; the agent's commands keep the user's TMPDIR.

An instance serves models, chat, speech and the balance only: the link,
/remote, the service and the hub are off, deletes are not sent, and the server
library, search, fetch, embeddings and personalization are not used.
Self-update and uninstall are refused. hardline_disable is ignored, and tools
treat the local directory as outside the project.

The smoke test runs a whole local session in the compiled binary and checks
that HOME, the XDG directories and TMPDIR gained nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -14,6 +14,20 @@ All notable changes to LLeMbas CLI. The format follows
   (nothing is written), and turns remote work on. `--json` prints one object,
   `{"enabled", "roots", "max_mode", "terminal"}`, with the defaults applied — for a program such as
   LLeMbas Desktop.
+- `lembas -l` / `lembas --local`: local mode. Config, sessions, memory, skills, the library,
+  snapshots, worktrees, caches, trust and history live in the project's git-ignored
+  `.agent/local/lembas/` (`.lembas/` where `.agent` is another tool's), and nothing is written
+  anywhere else — not even temporary files: the TUI starts with TMPDIR there, and the TUI library's
+  cache goes there too (the commands the agent runs keep your TMPDIR). Your logins and
+  connections.yaml are read, never written; your config.yaml is not read. A LLeMbas instance is
+  used for its models, chat, speech in and out and the balance only: no link, `/remote`, service or
+  hub, no deletes sent, no server library, no search, fetch or embeddings through it, no account
+  personalization, and no self-update. The instance still records each request's usage, as any API
+  does. `-l` does not trust the project by itself; the first start asks, and the answer is kept in
+  the local directory. A local directory the repository carries is refused, `hardline_disable` is
+  ignored, and tools treat the local directory as outside the project: no tool writes there (but
+  in its worktrees), and reading it asks as anything outside the project does. The status bar says
+  `local`, and `lembas -l --help` explains it.
 
 ### Changed