run the chroot in a new PID namespace

This automatically tears down any processes remaining in the chroot
when we exit. I'm looking at you, gnupg.