Choose correctly between bwrap --bind, --ro-bind and --dev-bind and make only one working directory writable

Documented steps

1. Requirements / auth: No credentials. Requires bubblewrap and unprivileged user namespaces; the invoking user must already be able to read SRC on the host (bwrap grants no new host access).
2. Default to `--ro-bind SRC DEST` for everything the sandboxed process only needs to read: system libraries, interpreters, config, input data. Read-only is the correct default for a sandbox root.
3. Use `--bind SRC DEST` only for the single path the process is allowed to modify, e.g. `--bind $PWD/out /workspace/out`. Keep the writable set as small as the task allows.
4. Use `--dev-bind SRC DEST` only when the process genuinely needs device access through the bind (it is `--bind` plus permission to access devices). Treat it as a privileged operation, not a stronger `--bind`.
5. Use the `-try` variants (`--bind-try`, `--ro-bind-try`, `--dev-bind-try`) for optional host paths: they behave identically but silently ignore a non-existent SRC instead of failing the whole sandbox.
6. Replace whole directory subtrees you want to hide with `--tmpfs DEST`, and size it explicitly by putting `--size BYTES` immediately before the `--tmpfs` it applies to.
7. Downgrade a single already-mounted path to read-only with `--remount-ro DEST` — it affects only that exact mount point and does not recurse into mount points beneath it.
8. Verify the result from inside before trusting it: `bwrap ... --ro-bind / / --bind $PWD/out /out sh -c 'cat /proc/self/mountinfo; touch /etc/proof 2>&1'` and confirm the write is refused.
9. Official documentation: https://manpages.debian.org/unstable/bubblewrap/bwrap.1.en.html