LXC: Use a shell wrapper script instead of inlining args

This refs #16144 and the pb with temporary scripts (CVE)
I think this was an oversight on my part in #16144 -- the new quoting is keeping $PATH from being expanded. There's a simpler fix than making a wrapper script. WIll submit an alternate soon for @kiorky to test.