Add mask option to hide paths/files from sandbox

src/cli.rs

@@ -54,6 +54,10 @@ pub struct Args {
     #[arg(long)]
     pub no_config: bool,
 
+    /// Hide a path inside the sandbox with a tmpfs overlay (repeatable)
+    #[arg(long = "mask", value_name = "PATH", action = clap::ArgAction::Append)]
+    pub mask: Vec<PathBuf>,
+
     /// Command and arguments to run inside the sandbox
     #[arg(trailing_var_arg = true, allow_hyphen_values = true)]
     pub command_and_args: Vec<OsString>,