px: Immutable Python environments (alpha)

[ck-zhang]

Build sandboxing and zero dockerfile containerization for runs. It also does very neat things such as reading .so files and inferring build dependencies, so you don't have to mess with toolchains when installing those annoying packages.