- netvm-chrome.sh --contained: bwrap fs jail inside netns (profile
home only + vault ro at /tmp/vault, Chromium sandbox stays on)
- netvm-proton.sh: run proton-cli as the profile identity in netns
+ jail (config dir + static binary, PROTON_NO_INPUT=1)
operator