Make coverage reports self-identify
We can change AppArmor to not grant access to all of /tmp, and virtualenvs don't need the system Python libraries.
Do the right things with symlinks.