programs: delfin: sandbox with bwrap

hosts/common/programs/assorted.nix

@@ -229,6 +229,9 @@ in
     cargo.persist.byStore.plaintext = [ ".cargo" ];
 
     # auth token, preferences
+    delfin.sandbox.method = "bwrap";
+    delfin.sandbox.wrapperType = "wrappedDerivation";
+    delfin.sandbox.whitelistDri = true;
     delfin.persist.byStore.private = [ ".config/delfin" ];
 
     # creds, but also 200 MB of node modules, etc