Phase 8: sandboxed-app identity (Flatpak/firejail/bwrap)

[timkicker]

Sprint D's identity resolver assumes /proc/{pid}/exe points at the actual app binary. For sandboxed processes (Flatpak, firejail, bwrap) it points at the sandbox wrapper, not the real binary. Identity resolution silently mis-routes such apps as UnknownBinary or system.

Needs: detect sandbox wrapper (e.g. bwrap, flatpak-bwrap), drill down to the contained-app binary path via /proc/{pid}/cwd or sandbox-specific introspection, map to app_id.

Phase 8 work since first-party apps come first; defer until Flatpak-installed third-party apps are real.