landlock is applied only to the ui process to drop fs access and in the fs process to limit where telescope can read/write files. The network process is more difficult to landlock because while in theory it doesn't need *any* fs access, in practice it needs to read (at least) files inside /etc/ for DNS to work.

it's good for thing like images and text with weird encodings.

now that we have a bounch of -Wxxx flags during compilation, let's fix everything.