run-bundle: Use pivot_root instead of chroot

If the supervisor runs in a chroot, remounting root MS_REC | MS_PRIVATE will
fail, and user namespaces cannot be used inside a chroot.
supervisor: Add raiiOpen and missing O_CLOEXEC flags