model hardening

Practical Linux-first guide to hardening local LLMs: why 'local' isn’t automatically secure; verify binaries and model weights (checksums/GPG); run with least privilege and read-only model dirs; block outbound by default (firejail/nftables); manage secrets safely (pass, strict perms); audit and update with auditd; includes copy-pasteable apt/dnf/zypper commands and a llama.cpp walkthrough to run offline with logs and compliance-by-default.