Securing Agents with NemoClaw and OpenShell