On Debian 13 (bookworm+), /bin, /lib, /sbin, /lib64 are symlinks to
/usr/*. bwrap --ro-bind cannot create a symlink as a mount target
inside the sandbox, causing "execvp: No such file or directory" because
the ELF dynamic linker at /lib64/ld-linux-x86-64.so.2 is unreachable.
Detect symlinks at runtime with os.path.islink() and use bwrap
--symlink instead of --ro-bind. Falls back to --ro-bind on older
distros where these are real directories.