Control a bubblewrap (bwrap) sandbox's process lifecycle so an untrusted child is killed when its parent dies, zombies are reaped correctly, and PID 1 semantics inside the sandbox are explicit.

Documented steps

1. Guarantee the sandboxed process tree dies if the launching process dies unexpectedly: add `--die-with-parent`. Per bwrap.xml (https://raw.githubusercontent.com/containers/bubblewrap/main/bwrap.xml), this 'kills (SIGKILL) all bwrap sandbox processes in sequence from parent to child including COMMAND process when bwrap or bwrap's parent dies,' using PR_SET_PDEATHSIG.
2. Isolate the process table and get automatic zombie reaping: add `--unshare-pid`. bwrap.xml: 'bwrap is running a minimal pid 1 process in the sandbox that is responsible for reaping zombies,' and it 'detects when the initial application process (pid 2) dies and reports its exit status back to the original spawner.'
3. Confirm exit-code propagation: `bwrap --unshare-pid --die-with-parent --ro-bind /usr /usr --proc /proc --dev /dev sh -c 'exit 7'; echo $?` should print 7, since 'the bwrap command returns the exit status of the initial application process (pid 2 in the sandbox)' (bwrap.xml, 'Exit status').
4. If COMMAND must literally run as PID 1 (e.g. it does its own signal/zombie handling, like an init system), pass `--as-pid-1`, which tells bwrap to 'not create a process with PID=1 in the sandbox to reap child processes' — only use this if COMMAND correctly reaps its own children.
5. Combine `--unshare-pid` and `--die-with-parent` in a self-cleaning launcher: `bwrap --unshare-pid --die-with-parent --ro-bind / / --proc /proc --dev /dev COMMAND`.