Sandbox the dev host on Linux (bwrap or Landlock), like --sandbox on macOS #897

Follow-up to #896. run desktop --sandbox only jails on macOS (Seatbelt). On Linux it prints a notice and runs unjailed. Candidates: bwrap with the same deny-list bound over tmpfs, or Landlock. CI's boot.ts runs on Linux runners, where it matters less than on the owner's Mac.

🤖 Generated with Claude Code