Somewhat less security-loosening steps now documented:
I’ve tested this on Kubuntu 26.04.1 LTS, and it works, but note that my system had kernel.apparmor_restrict_unprivileged_userns = 0 set previously, and I have not tested if these instructions work when that setting is absent. If someone could try that, that would be much appreciated, otherwise I’ll try to get around to it.