--dev-bind isn't necessary in any case it was being used for. We can
also use --ro-bind for /void-packages.
A possible future improvement would be to mount / read only during the
actual build.
Also exec bwrap, as done in the uchroot and uunshare chroot styles. And
update homepage.
6c7c41b120