LWN's article on unveil() is a good explanation - the restrictions are permanently applied to the process and its children until termination:
https://lwn.net/Articles/767137/
Someone gave me a book called "Danger UXB", about the teams that removed unexploded bombs across the UK during and after WWII, which was unexpectedly fascinating. Incredibly dangerous and painstaking work.
It's hopefully not too tricky - it can't be packaged as a crate using (say) debcargo, as the install path still requires CMake. The Debian experimental package changes are mostly about pulling in the right dependencies (including some internal mangling to support some policy choices).
If you want to write C++03, that's true, but as a maintainer of the fish build system I was having to backport compilers in order to use C++11 features on supported systems until 2020. Modern C++ is still a moving target and newer versions contain a number of features that make it much more pleasant to work with, but it takes decades to percolate into distributions.