On the upside, Opencode has finally nudged me to learn sandboxing via bwrap in Linux and sandbox-exec on Mac.