Fix a silly bug.

hgc-version was failing because I was appending the internal mount
directory onto the external mount point (and this had no effect
anyway because the external mount point was absolute).
Make system calls 'safe'.

All calls out to system are now done in a clean environment, to avoid
against an external attacker modifying environment variables in order
to execute other programs as root.

Also, where possible external calls have been replaced with library
functions using FFI.
Add the user into the container.

Still to do:
- Autologin
- Entry in /etc/shadow (not sure if this is needed)