Run an untrusted command with systemd's per-call sandbox (systemd-run --scope) with no persistence and immediate teardown

Documented steps

1. Run a transient sandbox in the current cgroup: systemd-run --scope --user=false -p ProtectSystem=strict -p ProtectHome=yes -p PrivateTmp=yes -p PrivateDevices=yes -p NoNewPrivileges=yes -p RestrictAddressFamilies=AF_UNIX -- /path/to/script
2. Clear capabilities and seccomp for the call: add -p CapabilityBoundingSet= -p SystemCallFilter='@system-service' -p MemoryDenyWriteExecute=yes
3. Use --description / --unit to tag the transient scope for observability (systemd-run -p ... --unit=tmp-test ...)
4. For a one-shot that must exit (journaling the result), add --wait so systemd-run blocks and returns the spawned command's exit status
5. Watch the live result: systemctl status run-u<id>.scope or journalctl -u run-u<id>.scope
6. Because no unit file is written, there is nothing to clean up after the process exits - the transient scope disappears automatically
7. Confirm the sandbox held, e.g. the process's /proc/<pid>/status shows NoNewPrivs=1 and Seccomp=2