Wrap everything in systemd-run. I documented some of it here on my shitty site. Some of the memory limits have changed over time, notably the browsers unit

https://pallissard.net/2022/06/27/limiting_application_resou...

Edit: I like your user space oomd idea though, that would be killer