Make ~/Downloads bind-mount exec.

Fixes #26
Bind-mount a non-encrypted chroot to reduce the scope of permission changes.