I continued developing and using these wrappers. With the latest release (0.3.0) they are now drop-in replacements for real Cargo and rust-analyzer for most practical workflows. The additional value that the wrappers provide is maintaining two useful and complementary security policies:
Minimize filesystem exposure. The wrappers grant each command access only to the workspace and tool state it needs.
Separate network access from code execution. Cargo subcommands whose purpose is dependency resolution or retrieval may get network access. Common build-like subcommands (like build or run) are split into a networked prefetch phase followed by the requested command in an offline sandbox. The wrapped rust-analyzer follows the same principle: it prefetches dependencies first, then launches real rust-analyzer offline.
I also worked hard on improving the documentation:
I hope that some people here will find these wrappers useful.