Drop capabilities for `run()` builtin

Right now, we drop uid/gid when we call run, and restore when we are done. I need to also explore dropping capabilities on Linux, though I believe those you cannot restore in the same way, so this needs some more exploration.

Start by locating the `run()` builtin and the existing uid/gid drop-and-restore logic. Research Linux capability semantics and determine which capabilities can be dropped and whether restoration is possible. Done means the intended capability behavior and its restoration limitations are defined and implemented.

Written by the indexing model from the issue text.