On this topic, while I was looking for something else :-) I found that Lix (and Nix?) has what they call “installables”, which ‘nix run’ runs in a container:
https://git.lix.systems/lix-project/lix/src/branch/main/lix/nix/run.md
‘nix run’ seems to have the same goal as the wrapper produced by ‘guix pack -R’: mapping the store at the right place in the application’s namespace. It’s not about running an application with the least authority.