sane-open: sandbox with bunpen

hosts/common/programs/sane-open.nix

@@ -1,7 +1,7 @@
 { ... }:
 {
   sane.programs.sane-open = {
-    sandbox.method = "bwrap";
+    sandbox.method = "bunpen";
     sandbox.autodetectCliPaths = "existing";  # for when opening a file
     sandbox.whitelistDbus = [ "user" ];
     sandbox.isolatePids = false;  #< to toggle keyboard
@@ -9,6 +9,7 @@
       ".local/share/applications"
     ];
     sandbox.extraRuntimePaths = [ "sway" ];  #< calls `swaymsg` to query rotation and see if there's room for a keyboard
+    sandbox.extraPaths = [ "/proc" ];  #< to be able to launch bwrap programs
     suggestedPrograms = [
       "gdbus"
       "xdg-utils"