Make bwrap sandbox processes reliably die with their parent and reap zombies correctly (--unshare-pid, --die-with-parent, --as-pid-1)

Documented steps

1. Requirements / auth: No credentials. Requires bubblewrap and unprivileged user namespaces.
2. Add `--unshare-pid` so the sandbox gets its own PID namespace and cannot see or signal host processes.
3. Leave bwrap's default reaper behavior in place: by default bwrap runs a process with PID 1 inside the sandbox whose job is to reap child processes, so orphaned grandchildren do not accumulate as zombies.
4. Add `--die-with-parent` so the sandbox is torn down when the process that launched bwrap goes away. It ensures the child COMMAND dies when bwrap's parent dies, sending SIGKILL to the bwrap sandbox processes in sequence.
5. Only use `--as-pid-1` when you deliberately want your command to be PID 1 itself — it tells bwrap not to create the reaping process. Do not combine it with a command that forks and never waits.
6. Collect the outcome from bwrap's exit status, which is the exit status of the initial application process (pid 2 in the sandbox) — note this is pid 2, because pid 1 is bwrap's reaper.
7. For supervisors that need the inner pid, add `--json-status-fd FD`: bwrap writes a JSON-lines document containing the child-pid at startup and the exit-code at termination.
8. Official documentation: https://manpages.debian.org/unstable/bubblewrap/bwrap.1.en.html | https://github.com/containers/bubblewrap/issues/529