feat: add paranoid mode

This is useful for when the build script runs on a machine where it can't be trusted with elevated privileges.

This PR pulls in some of the changes from #217.

## TODO

- [ ] Disable running services
- [ ] Disable addons