confine the prefix again after wine boots, and fix two manifest package names

Two things the live install found.

The manifest was refused at discovery. `apt: 'wine wine32:i386'` is two
packages and an architecture suffix, and a package name may be neither — nor
should it be, since `dpkg --add-architecture i386` has to happen first and no
package name can express that. And Fedora's Xvfb package is
`xorg-x11-server-Xvfb`, with a capital X, which a manifest package name may not
have; the dnf entry is dropped rather than guessed, which turns into an
instruction to the owner instead of a wrong install.

More importantly: confining the prefix before wine starts is a confinement wine
can undo. Observed directly — after a run, every com* link had come back with a
fresh timestamp, because wine rebuilds dosdevices when it boots a prefix it
thinks needs updating, and a wine package upgrade is enough to make it think
so. Z: did not come back that time, but "the dangerous one happened not to
regenerate" is not a property to rely on. confineAndVerify now runs again once
the game is up and says so if Z: returned.

Verified on the live server: Z: and the three home symlinks are gone from a
prefix that had them, run/ is mode 700, nothing listens on 5907, and the RFB
handshake arrives through the platform relay with a valid owner token and
through nothing else.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Officer-Session: 656f5c85-e49a-4f1f-b9f3-042a04b4d043

sidecar/session.ts

@@ -1,7 +1,7 @@
 import type { Subprocess } from 'bun';
 import { existsSync, rmSync } from 'node:fs';
 import { GAME_EXE, RUN_DIR, VNC_SOCKET, ensureDirs } from './paths';
-import { WINE_ENV, ensurePrefix, prefixReady } from './prefix';
+import { WINE_ENV, confineAndVerify, ensurePrefix, prefixReady } from './prefix';
 import { run, waitFor } from './run';
 
 /**
@@ -179,6 +179,11 @@ async function startInner(log: (line: string) => void): Promise<SessionStatus> {
     }
   }
 
+  // Wine has now booted the prefix, and booting it is what can restore `Z:`. The confinement in
+  // `ensurePrefix` happens before that, so on its own it would be undone by exactly the event it exists to
+  // survive. See `confineAndVerify`.
+  confineAndVerify(log);
+
   // ── the display server ──
   if (!alive(vnc)) {
     // A socket left by a crashed run refuses to bind. Removing it is safe: nothing else may write here.