Absolute path to the bubblewrap binary, or empty if not found.
Callers should use can_wrap before constructing Bubble.