Function maybe_dispatch 

pub fn maybe_dispatch<I: IntoIterator<Item = OsString>>(args: I) -> Option<i32>

If args (from std::env::args_os) is a __sandbox-exec invocation, apply the requested confinement and execve the wrapped command — returning Some(exit_code) only if we could not (a failure; on success execve replaces the process and this never returns). Returns None for any other invocation so the normal CLI proceeds.

Must run before the async runtime spawns worker threads, so the seccomp filter applies to a single-threaded image.