YORU: A Privilege-Bounded, Catalog-Constrained AI Agent Architecture for Continuous CIS-Based Hardening of Unmanaged Cloud Servers. Kohesi 2026, 11 (4).