This sounds like it would work. As you said it seems a little over engineered, but I'm not sure how else you would go about only isolating Firefox without a local split tunnel VPN that has a fail-safe switch controlling your network adapter. Would Firefox rely solely on the proxy configuration, or will it make any attempts at using another route if the proxy fails (or it's just programmed to for specific features/extensions/etc)?

If you want a fully isolated browser, you can install Firefox (or Mullvad browser) as a container behind Gluetun. You would then just enter the IP and HTTPS port of your Firefox container in your local instance of Firefox and connect via (web) VNC over Tailscale. All traffic to the container uses HTTPS, goes over Tailscale, and through your Gluetun. Then Firefox has no possibility of using anything but Gluetun, and your browsing (clipboard, audio, hardware info, etc) isn't connected to your laptop at all by default.

This may not be ideal if you're trying to watch a lot of high resolution or high framerate videos though, depending on how high your VNC quality is set and your network capabilities.

https://github.com/linuxserver/docker-firefox