Resolve

Block mount-point crossings (includes bind-mounts).

Block traversal through procfs-style "magic-links".

Block traversal through all symlinks (implies OEXT_NO_MAGICLINKS)

Block "lexical" trickery like "..", symlinks, and absolute paths which escape the dirfd.

Make all jumps to "/" and ".." be scoped inside the dirfd (similar to chroot(2)).