Sanitize the environment variables seen by a process inside a bubblewrap (bwrap) sandbox using --clearenv, --setenv, and --unsetenv, and set a custom argv[0] with --argv0.

Documented steps

1. Wipe the entire inherited environment before adding anything back: `bwrap --clearenv --setenv PATH /usr/bin --setenv HOME /home/sandboxuser --ro-bind /usr /usr --proc /proc --dev /dev COMMAND`. Per bwrap.xml (https://raw.githubusercontent.com/containers/bubblewrap/main/bwrap.xml), `--clearenv` unsets 'all environment variables, except for PWD and any that are subsequently set by --setenv.'
2. Add exactly the variables the sandboxed program needs, one at a time: `--setenv LANG C.UTF-8 --setenv TERM xterm-256color`.
3. Strip one sensitive variable while keeping the rest of the ambient environment: `--unsetenv SSH_AUTH_SOCK` (use instead of `--clearenv` when most of the inherited environment should be kept).
4. Normalize how the sandboxed process identifies itself in `ps`/`/proc/self/cmdline`: `bwrap --argv0 my-app-name /usr/bin/real-binary --some-flag`. bwrap.xml: `--argv0 VALUE` 'Set argv[0] to the value VALUE before running the program.'
5. Verify: `bwrap --clearenv --setenv PATH /usr/bin --argv0 renamed-proc /usr/bin/env` should print only PATH (and PWD) among the environment, and `ps` should show the process name as 'renamed-proc'.