> Coincidentally, I just published a tool to manage unprivileged chroots for testing ebuilds.
You should check out what ChromeOS is doing. They are using bazel to execute ebuilds inside an ephemeral chroot: https://chromium.googlesource.com/chromiumos/bazel/+/refs/he...
This way it's guaranteed that no undeclared dependencies get used.