Make the Rust client the sole app

app/ui-sandbox.sh

@@ -405,10 +405,7 @@ done
 # token with '+' in it enrols as one with a space, and nothing reports it.
 enc=$(python3 -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1], safe=""))' "$TOKEN")
 # The CA rides in the link (`wg_app_link::enroll::ca_param`: base64url of
-# the DER, which needs no percent-encoding). The Compose app ignores it and
-# pins the copy its APK was built with; the iris app has no baked copy at
-# all -- it is cross-compiled and could be pointed at any machine -- so
-# without this it enrols and then trusts nothing. Minted here rather than by
+# the DER, which needs no percent-encoding). Minted here rather than by
 # `--enroll-link` because this token is the sandbox's own, carried across
 # restarts so the emulator stays enrolled (see the top of this file).
 ca=$(python3 - "$CERTS/ca.pem" <<'CA'