Landlock wrapper fails when fence binary is installed in home directory

[ghost91-]

Steps to Reproduce

1. Install fence to ~/.local/bin/ (default location)
2. Create a directory and config:

   mkdir -p ~/.cache/test
   echo '{"filesystem":{"allowWrite":["~/.cache/test"]}}' > /tmp/test-fence.json

3. Run from any subdirectory:

   fence --settings /tmp/test-fence.json -- ls

Expected Behavior

Command runs in sandbox.

Actual Behavior

/usr/bin/bash: Line 110: /home/user/.local/bin/fence: No such file or directory

Cause

When allowWrite entries exist under /home, fence creates --tmpfs /home and bind-mounts only the specified paths. When Landlock is enabled, fence re-executes itself with --landlock-apply inside the sandbox, but the binary at ~/.local/bin/fence is hidden by the tmpfs.

Workaround

Install fence to a system path:

sudo cp ~/.local/bin/fence /usr/local/bin/