This regressed when we moved to bubblewrap. We need to always use
a direct bind for building, because it may not necessarily happen
in a real user session where the session-helper works.
We need to keep all the fd:s needed for bubblewrap alive, so
neuter g_spawn_async:s close of fds and do our own.
Also, we need this so these fds can be closed in the launching app.
