Add or drop Linux capabilities for a bubblewrap (bwrap) sandbox with --cap-add and --cap-drop, understanding this only has an effect when bwrap itself is invoked with elevated privilege.

Documented steps

1. Explicitly drop everything to document intent, matching the documented default: `bwrap --cap-drop ALL --ro-bind /usr /usr --proc /proc --dev /dev COMMAND`. Per bwrap.xml (https://raw.githubusercontent.com/containers/bubblewrap/main/bwrap.xml), 'By default no caps are left in the sandboxed process,' and `--cap-drop` 'accepts the special value ALL to drop all the caps.'
2. Grant one narrowly-scoped capability when running with privilege: `bwrap --cap-drop ALL --cap-add CAP_DAC_READ_SEARCH --ro-bind /usr /usr --proc /proc --dev /dev COMMAND` — bwrap.xml gives this exact example: 'Add the specified capability CAP, e.g. CAP_DAC_READ_SEARCH, when running as privileged user.'
3. Respect command-line ordering since add/drop are processed sequentially: `bwrap --cap-add ALL --cap-drop CAP_SYS_ADMIN --cap-drop CAP_NET_ADMIN ...` grants everything then removes two caps. bwrap.xml: 'The --cap-add and --cap-drop options are processed in the order they are specified on the command line. Please be careful to the order they are specified.'
4. Verify effective capabilities inside the sandbox: `bwrap --cap-drop ALL --cap-add CAP_NET_BIND_SERVICE --ro-bind /usr /usr --proc /proc --dev /dev capsh --print` and confirm only the intended capability is listed.