fix(golden): support Stado sandboxing on Ubuntu

[foobarto]

Summary

• add Stado sandbox prerequisites (bwrap and pasta) to every golden
• enable Ubuntu AppArmor's restricted bwrap profile without weakening the global user-namespace control
• verify the bwrap network namespace path and pasta --splice-only in new goldens

Validation

• bash -n bin/devbox
• make test (82 Bats + 33 Python tests)
• make lint
• git diff --check
• node --check docs/assets/site.js

No existing Devbox instance was started or restarted.

[Copilot]

Pull request overview

This PR updates Devbox golden image provisioning and verification to support Stado’s Linux sandboxing on Ubuntu (notably Ubuntu 24.04’s AppArmor user-namespace restrictions) by ensuring required sandbox helper tools are present and by enabling a scoped AppArmor profile for bwrap.

Changes:

• Install sandbox prerequisites in goldens (bubblewrap/bwrap and passt/pasta), plus Ubuntu AppArmor packages for the restricted bwrap profile.
• Add an Ubuntu 24.04-specific provisioning step to load AppArmor’s bwrap-userns-restrict profile without disabling the global user-namespace restriction.
• Extend golden verification and Bats tests to assert presence/usability of bwrap and pasta --splice-only.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File	Description
bin/devbox	Adds packages to golden provisioning, loads Ubuntu’s restricted bwrap AppArmor profile, and extends golden verification to exercise bwrap/pasta.
test/devbox.bats	Adds tests to assert the golden YAML and verification logic include the new sandbox prerequisites and Ubuntu AppArmor policy behavior.
README.md	Documents the new golden sandbox helpers and the Ubuntu 24.04 AppArmor behavior/intent.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.