I think that is probably excessive, a terminal is hardly as complex as a web browser. screen or tmux (or even mosh) can essentially act as a terminal firewall,

I think that is probably excessive, a terminal is hardly as complex as a web browser. screen or tmux (or even mosh) can essentially act as a terminal firewall, as they interpret escape sequences and maintain a virtual “screen”. Then you can sandbox their process in docker or similar. Or if you want web browser style sandboxing maybe just using Xterm.js could work.