locally-written launch script unexpectedly allows sandboxed app to overwrite its own .desktop file

I'm running Telegram binary software under bwrap with limited access to file system. But one in a while I see telegram some how replace my starter desktop file with it's own script which causing next start of telegram become unprotected by bwrap.

Here is full bwrap command:

```
axet 3531936 0.0 0.0 3576 2092 ? S 16:42 0:00 bwrap --dev-bind / / --tmpfs /home/axet --ro-bind /home/axet/bin /home/axet/bin --ro-bind /home/axet/.config /home/axet/.config --ro-bind /home/axet/.local/share/wineprefixes /home/axet/.local/share/wineprefixes --bind /home/axet/.cache/telegram-desktop /home/axet/.cache/telegram-desktop --bind /home/axet/.local/share/TelegramDesktop /home/axet/.local/share/TelegramDesktop --bind /home/axet/Downloads /home/axet/Downloads --bind /home/axet/Soft/telegram /home/axet/Soft/telegram --bind /tmp /tmp --bind /home/axet/Soft/telegram /home/axet/Soft/telegram /home/axet/Soft/telegram//Telegram
```

As you can see I only granted access only to some folders but somehow telegram changes `~/.local/share/applications` and remove my `telegram.desktop` script adds its own script:

```
# ll .local/share/applications/ | grep teleg
-rwxrwxr-x+ 1 axet axet 612 авг 3 20:10 org.telegram.desktop._65f73dc27c0fb30cb1424daa92f46251.desktop
```

I have no idea how this happens. Maybe because simple mistake in launch scripts. Maybe dbus allow to create/replace old desktop files.

My startup scripts based on `homebin` shell script and dependent `telegram` sh script:

* https://gitlab.com/axet/homebin/-/blob/debian/homebin
* https://gitlab.com/axet/homebin/-/blob/debian/homebin.d/web/telegram