feat: add paranoid mode

This is useful for when the build script runs on a machine where it can't be trusted with elevated privileges.

This PR pulls in some of the changes from #217.

## TODO

- [x] Disable running services
- [x] Disable addons