Docs: Add Binance trading hardening and OpenClaw skill sandbox guidance

[johnnyclem]

Motivation

• Clarify threat-model guidance for exchange-connected agents and automated trading workloads to reduce risk from compromised hosts or keys.
• Provide concrete operational controls and a minimal runtime sandbox for OpenClaw/Claw-style skills to limit blast radius of untrusted skill execution.

Description

• Updated docs/security/best-practices.md to add weekly Binance API key rotation, API key IP whitelisting, and recommendation to route trading traffic through a hardened VPS with firewall egress controls.
• Added a short UFW runbook example showing how to restrict outbound traffic to Binance hosts and how to restrict SSH to trusted admin IPs.
• Added a new "Skill Runtime Sandboxing" section recommending non-root execution, denying writes outside /tmp, read-only runtime mounts, and process-level isolation, plus a minimal hardened docker run example.
• Adjusted the operational checklist to require weekly Binance API key rotation instead of the previous monthly note.

Testing

• Ran npm run typecheck, which failed due to pre-existing, unrelated TypeScript errors in cli/commands/pilot.ts and src/pilot/private-replica.ts, so no typecheck pass was produced for this docs-only change.
• No runtime code was modified and no other automated tests were executed for this PR.

---

Codex Task

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
agent-vault	Ready	Preview, Comment	Apr 26, 2026 2:49pm
agentvault	Ready	Preview, Comment	Apr 26, 2026 2:49pm