fix: give the CI sandbox tests a working bwrap

Ubuntu 24.04 blocks the unprivileged user namespaces bubblewrap needs, so the campaign refused to run the fake cores and four FakeCorePasses tests failed, also inside the no-jsonschema replay. CI now installs bubblewrap, lifts the AppArmor restriction and proves a sandbox starts. Locally the tests name the missing sandbox instead of failing on a KeyError.

.github/workflows/validate.yml

@@ -239,6 +239,16 @@ jobs:
       - name: Check that shellcheck is installed
         run: shellcheck --version
 
+      # core_probe and the campaign run third-party cores only inside a
+      # bubblewrap sandbox and refuse without one. Ubuntu 24.04 blocks the
+      # unprivileged user namespaces bwrap needs, so the campaign tests saw
+      # "refused". The last command proves a sandbox starts.
+      - name: Give the sandbox tests a working bubblewrap
+        run: |
+          sudo apt-get install -y --no-install-recommends bubblewrap
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+          bwrap --ro-bind /usr /usr --symlink usr/lib /lib --symlink usr/lib64 /lib64 --symlink usr/bin /bin --proc /proc --dev /dev --unshare-all /bin/true
+
       # The site is built as deploy-site.yml builds it, from the lockfile.
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
         with: