integration with `nono` to run builds in sandboxed environment

see https://docs.nono.sh/usage/examples#build-tools

Can be used to easily block internet access, or only allow (read/write) access to specific paths on the filesystems (excluding `$HOME`, for example)...