fix(docker): prevent privilege regain after bootstrap

Co-authored-by: yu-xin-c <175149126+yu-xin-c@users.noreply.github.com>

.github/workflows/ci.yml

@@ -189,10 +189,47 @@ jobs:
       - name: Build image with default channel dependencies
         run: docker build -t nanobot:test .
 
-      - name: Verify Docker Compose startup
+      - name: Verify Docker Compose startup and privilege boundary
         env:
           HOME: ${{ runner.temp }}
-        run: docker compose run --rm --no-deps --build -T nanobot-cli status
+        run: |
+          docker compose run --rm --no-deps --build -T nanobot-cli status
+          docker compose run --rm --no-deps -T --entrypoint sh nanobot-cli -s <<'OUTER'
+          set -eu
+          field() {
+            awk -v key="$1:" '$1 == key { print $2 }' /proc/self/status
+          }
+          test "$(id -u)" = "0"
+          test "$(field NoNewPrivs)" = "1"
+          setpriv --reuid=nanobot --regid=nanobot --init-groups sh -s <<'INNER'
+          set -eu
+          field() {
+            awk -v key="$1:" '$1 == key { print $2 }' /proc/self/status
+          }
+          test "$(id -u)" = "1000"
+          test "$(field NoNewPrivs)" = "1"
+          for capability_set in CapInh CapPrm CapEff CapAmb; do
+            test "$(field "$capability_set")" = "0000000000000000"
+          done
+          INNER
+          OUTER
+          docker compose -f docker-compose.yml -f docker-compose.bwrap.yml \
+            run --rm --no-deps -T --entrypoint sh nanobot-cli -s <<'BWRAP'
+          set -eu
+          mkdir -p /home/nanobot/.nanobot/workspace
+          chown -R nanobot:nanobot /home/nanobot/.nanobot
+          setpriv --reuid=nanobot --regid=nanobot --init-groups \
+            bwrap --new-session --die-with-parent \
+            --ro-bind /usr /usr \
+            --ro-bind-try /bin /bin \
+            --ro-bind-try /lib /lib \
+            --ro-bind-try /lib64 /lib64 \
+            --proc /proc --dev /dev --tmpfs /tmp \
+            --bind /home/nanobot/.nanobot/workspace /home/nanobot/.nanobot/workspace \
+            --chdir /home/nanobot/.nanobot/workspace \
+            -- sh -c 'test "$(id -u)" = 1000; touch sandbox-ok'
+          test -f /home/nanobot/.nanobot/workspace/sandbox-ok
+          BWRAP
 
       - name: Verify default WhatsApp dependencies
         run: docker run --rm --entrypoint python nanobot:test -c "import neonize, segno"