Control user-namespace identity in a bwrap sandbox and prevent nested user namespaces (--unshare-user, --uid/--gid, --userns, --disable-userns)

Documented steps

1. Requirements / auth: No credentials, but the host must permit unprivileged user namespaces. Setuid installation is deprecated as of bubblewrap 0.11.2 and disables several of these options.
2. Add `--unshare-user` to create a new user namespace. Use `--unshare-user-try` only when you want bwrap to continue silently on hosts where user namespaces are unavailable.
3. Set the in-sandbox identity with `--uid UID` and `--gid GID`. Both options require `--unshare-user`, so add it explicitly rather than relying on the `-try` form inside `--unshare-all`.
4. To run inside a user namespace you prepared elsewhere, pass it as a file descriptor with `--userns FD` instead of creating one. `--userns` is incompatible with `--unshare-user` and is unavailable when bwrap is installed setuid.
5. To hop into a second namespace after setup completes, add `--userns2 FD`; it only works together with `--userns`.
6. Block namespace-based escapes by adding `--disable-userns`, which prevents the process in the sandbox from creating further user namespaces so it cannot rearrange the filesystem namespace. It requires `--unshare-user` and is unavailable setuid.
7. From inside the sandbox, assert the lockdown actually took effect with `--assert-userns-disabled`, which confirms the process has been prevented from creating further user namespaces without taking any other action.
8. If an external helper must write the uid/gid maps (newuidmap/newgidmap), coordinate with `--userns-block-fd FD`: bwrap waits for data on that FD before initializing the user namespace.
9. Official documentation: https://manpages.debian.org/unstable/bubblewrap/bwrap.1.en.html | https://github.com/containers/bubblewrap/releases