oath-toolkit,sops: sandbox with bunpen

hosts/common/programs/assorted.nix

@@ -971,7 +971,7 @@ in
     nvme-cli.sandbox.capabilities = [ "sys_rawio" ];
 
     # contains only `oathtool`, which i only use for evaluating TOTP codes from CLI/stdin
-    oath-toolkit.sandbox.method = "bwrap";
+    oath-toolkit.sandbox.method = "bunpen";
 
     # settings (electron app)
     obsidian.persist.byStore.plaintext = [ ".config/obsidian" ];
@@ -1115,7 +1115,7 @@ in
     # TODO: enable dma heaps for more efficient buffer sharing: <https://gitlab.com/postmarketOS/pmaports/-/issues/2789>
     snapshot = {};
 
-    sops.sandbox.method = "bwrap";
+    sops.sandbox.method = "bunpen";
     sops.sandbox.extraHomePaths = [
       ".config/sops"
       "nixos"