Add strict bubblewrap sandbox profile for untrusted binaries

[leafo]

Add a future opt-in strict bubblewrap profile for users who want stronger isolation than the current compatibility-first sandbox.

Current bubblewrap defaults intentionally prioritize game compatibility (graphics/audio/input/session integration). That is appropriate for most launches, but it is not a strong baseline for truly untrusted software downloaded from the internet.

Edit: We now have RunnerParams.SandboxConfig.PolicyMode so we can expose different policies for the user to select

Scope (strict profile)

• Keep compatibility profile as default.
• Add a strict profile behind explicit opt-in.
• Start from deny-by-default on host integrations and selectively re-enable.

Proposed behavior

• Keep clearenv + allowlist environment model.
• Default-deny X11, /dev/input, and session D-Bus in strict mode.
• Prefer Wayland-only path where possible.
• Optional unshare-net in strict mode.
• Validate and sanitize env-derived mount paths before binding.
• Restrict writable binds to minimum required paths.

Implementation notes

• Introduce a sandbox profile enum/flag (e.g. compat, strict) in runner params.
• Branch mount/device/socket policy in runner/bubblewrap_linux.go by profile.
• Preserve existing behavior for current users unless strict is selected.

Testing

• Add integration tests in runner/runner_test.go for strict mode policy boundaries.
• Add unit tests for path validation/parser logic.
• Add docs describing threat model differences between compat and strict.

Non-goals

• Replacing Flatpak or distro-level confinement.
• Eliminating all compatibility breakage in strict mode.