security bug: upgrades and downgrades destroy keybase firejailing

The keybase server (currently mislabeled as a "commandline client") has no proxy support. This means (amid other security issues) that diligent and defensive admins will modify the `run_keybase` script so as to prepend the executables with something like:
```
firejail --net=vnet0 --private="$(mktemp -d)" --profile=/etc/firejail/keybase.profile ...
```
When keybase is upgraded or downgraded, that code is silently reversed, leaving users defenseless. And worse, an upgrade can also occur silently (see https://github.com/keybase/client/issues/9756).

The issue points to the run_keybase script and the upgrade/downgrade path, but names no repository file or test. Start by locating that script and the code or packaging flow that replaces it; verify upgrade and downgrade behavior, with completion defined as preserving firejail customization rather than silently reversing it.

Written by the indexing model from the issue text.