Strict confinement uses a private runtime directory while the Wayland socket remains in the host directory. Resolve the accessible socket path, provide bundled XKB data, and fall back to X11 only when needed.
