programs: sandbox oathtools

hosts/common/programs/assorted.nix

@@ -693,6 +693,10 @@ in
     ];
     nvme-cli.sandbox.capabilities = [ "sys_rawio" ];
 
+    # contains only `oathtool`, which i only use for evaluating TOTP codes from CLI/stdin
+    oath-toolkit.sandbox.method = "bwrap";
+    oath-toolkit.sandbox.wrapperType = "wrappedDerivation";
+
     # settings (electron app)
     obsidian.persist.byStore.plaintext = [ ".config/obsidian" ];