feat: pin bwrap rein runtimes and isolate private state

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb

tests/test_bwrap.py

@@ -298,12 +298,20 @@ def test_in_namespace_runner_uses_sanitized_environment(tmp_path) -> None:
     ]
     assert set(child_env) == {
         "HOME",
+        "XDG_CONFIG_HOME",
+        "XDG_CACHE_HOME",
+        "XDG_STATE_HOME",
+        "TMPDIR",
+        "PYTHONDONTWRITEBYTECODE",
+        "PYTHONNOUSERSITE",
         "LANG",
         "PATH",
         "SANDBOXER_CREDENTIAL_ROUTE_REFS",
         "SANDBOXER_ACTOR",
         "SANDBOXER_RUN_ID",
     }
+    assert child_env["HOME"] == "/run/sandboxer/state/home"
+    assert child_env["HOME"] != str(tmp_path)
     assert result["stdout"] == "ok\n"