Inject files or data into a bubblewrap sandbox via file descriptors (--file, --bind-data, --ro-bind-data, --perms)

Documented steps

1. Open the data as an fd in the launching shell, e.g. process substitution as the official demo does: --file 11 /etc/passwd ... 11< <(getent passwd $UID 65534).
2. Copy bytes from an fd to a path: --file FD DEST.
3. Bind-mount a file built from the fd's content (writable): --bind-data FD DEST.
4. Read-only variant: --ro-bind-data FD DEST.
5. Set explicit permissions by preceding the operation with --perms OCTAL — --perms 'does nothing on its own' and affects only the next option.
6. Model on the demo, which synthesizes stub /etc/passwd and /etc/group this way (11< and 12< process substitutions).
7. Remember these are one-shot copies taken at sandbox setup — not live bindings to the data's origin.
8. Reference (official docs): https://raw.githubusercontent.com/containers/bubblewrap/main/bwrap.xml ; https://raw.githubusercontent.com/containers/bubblewrap/main/demos/bubblewrap-shell.sh