Have a specific exit code for when sandboxing is not possible

Since there are a bunch of environments where sandboxing doesn't work like in a libgnome-desktop sandbox or some CIs, we want to do opportunistic sandboxing. We are now doing this in glycin by testing if bwrap was called with SIGSYS (happens in CIs) or if it's STDERR contains a string indicating that spawning failed due to failing to create namespace [glycin!295](https://gitlab.gnome.org/GNOME/glycin/-/merge_requests/295).

While there is no clear answer to what "sandboxing not being available" means, at least for the failed `clone` syscalls it would be good to have a more specific exit code than just `1`. Following the 128+n convention would be one option.