ef2a4c419a
- netvm-chrome.sh --contained: bwrap fs jail inside netns (profile home only + vault ro at /tmp/vault, Chromium sandbox stays on) - netvm-proton.sh: run proton-cli as the profile identity in netns + jail (config dir + static binary, PROTON_NO_INPUT=1)