So.... you're afraid of the command that does the thing you're trying to do?

Flatpak is itself a file manager.

That duplicate of your folder in /run is due to filesystem links (or more likely a fuse mount, I've never actually looked into how flatpak works). But either way, they aren't copies of the data.

Don't "declutter" manually. Use your package manager.

The above is accurate, and can be considered accurate for any directory below or at well.

Per /run, it's also mounted in memory, so trying to "declutter" it won't get you anywhere and things will return on reboot.

I use an app called paperkarma. You send them a pic of the junk, they manually unsubscribe you.

They've gone to a subscription model because of course they have, I'd be eager to hear about alternatives if any exist.

I'd imagine tar is included with the install media.

I could be wrong, but isn't the entire debian stable tree maintained for years via open source contributions? Sure the redhat downstreams might be on their own, but there's plenty of non-commercial distros that keep up to date.

You really don't need to be that paranoid for personal stuff. Use a cookie manager extension like NoCookie, NoScript, uBlock Origin, and isolate with Firefox Containers.

The idea of an "attack surface" from extensions is valid enough, but you can improve your overall security posture with more good extensions thanv trying to manually maintain everything yourself.

1. No. Your desktop password manager is encrypted with a strong passphrase that locks when you're computer locks. (Right?) They'd have to snatch your gear mid-session. Cookies are not safe, and cookie hijacks are a pretty common exploit. Cookies are for convenience, not security. Retaining authentication cookies is a very big security hole that we all do, and it's why banks don't let you re-auth on a previous session cookie.

2. "Pretty hard to break into" is the kind of phrase that keeps infosec people up at night. It's the kind of phrase that reads to me as "full of vulnerabilities so I can easily break in." You probably want to read up on your security practices.

3. Yes. First party cookies can be just as nefarious in addition to the technical requirements. Cookie managers are more relaxed about first party because we assume you're on that site for a reason, not because the cookies aren't a risk.

3a. Never assume that something supposed to be "mostly benign" isn't currently being exploited for bad reasons.

To your OP, It's actually not a terrible idea to uninstall the PW manager browser extension. It's one more layer of isolation from the browser. You just lose the convenience of autofill.

But definitely rely on the PW manager for session security and not cookies.

Edit: a couple edits.