Rebuild authorized_keys out of process, since the sandbox forbids sudo
Sandbox the makenotwork unit, on a measured write set
Delete the stale server unit file; the bootstrap script is the real one