Remove nobody containment from slugbuilder (retaining it for slugrunner)

Call this `maybe_run_privileged` or similar.