Ensure a bubblewrap sandbox dies with its parent and monitor it via --json-status-fd / --info-fd

Documented steps

1. Add --die-with-parent: kills (SIGKILL) all bwrap sandbox processes, including COMMAND, when bwrap or bwrap's parent dies (implemented via prctl PR_SET_PDEATHSIG).
2. Open a writable fd in the calling process and pass --info-fd FD to receive JSON information about the sandbox.
3. Pass --json-status-fd FD for lifecycle events: multiple JSON documents are written to the fd, one per line; after the child starts, an object with a child-pid member is written.
4. In the controlling process, read the status fd as a newline-delimited JSON stream (start event, later exit).
5. Combine --die-with-parent with --json-status-fd so the monitor both tracks the child and guarantees the sandbox cannot outlive it.
6. Also check bwrap's own exit code, which mirrors the initial application process's exit status.
7. Reference (official docs): https://raw.githubusercontent.com/containers/bubblewrap/main/bwrap.xml