lembas -l / --local: everything in the project, nothing written elsewhere

Config, data and state are rooted at <project>/.agent/local/lembas (or
.lembas/), kept out of git; a local directory the repository carries is
refused. The user's logins and connections.yaml are read, never written; the
user's config.yaml is not read. The TUI is started with TMPDIR inside it (the
compiled binary unpacks its native library there) and OpenTUI's cache goes
there too; the agent's commands keep the user's TMPDIR.

An instance serves models, chat, speech and the balance only: the link,
/remote, the service and the hub are off, deletes are not sent, and the server
library, search, fetch, embeddings and personalization are not used.
Self-update and uninstall are refused. hardline_disable is ignored, and tools
treat the local directory as outside the project.

The smoke test runs a whole local session in the compiled binary and checks
that HOME, the XDG directories and TMPDIR gained nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/acp/link.ts

@@ -9,6 +9,7 @@
 import { existsSync, readFileSync } from "node:fs"
 import { hostname } from "node:os"
 import { remoteBlock } from "../config/remote.ts"
+import { refusedLocally } from "../project/local.ts"
 import type { Mode } from "../config/schema.ts"
 import { HARNESS_VERSION } from "../harness.ts"
 import { instances, keyFile, rememberProtocols, type Instance } from "../lembas/login.ts"
@@ -124,6 +125,8 @@ export interface LinkOptions {
  *  `roots: []` and can tell a device that allows no folder yet from one that is not running, and a
  *  `lembas remote add` or `enable` makes it serve, without a restart. */
 export async function runLink(o: LinkOptions = {}): Promise<LinkStatus> {
+  const local = refusedLocally("the link to a LLeMbas instance (lembas service, /remote)")
+  if (local) throw new LinkError(local)
   const limits = limitsFromConfig({ sharedOnly: o.sharedOnly })
   const poll = o.pollMs ?? 2000
   const instance = pickInstance(o.instance)