shell: Run firejail inside limit.sh, make NO_EXECVE work