arXiv cs.CR·2d agoHESP: Separating What to Probe from When to Stop in Local LLM Alert-Triage Agents#soc#alert-triage#llm-agentsResearch