Kavach Run

Wraps a subprocess in kavachos kernel enforcement (seccomp-bpf + cgroup BPF egress). Linux only — gracefully degrades on macOS/Windows with a warning. Use after KavachGate for defense in depth: policy gate + kernel enforcement.

Discussion