fix: give the CI sandbox tests a working bwrap

Ubuntu 24.04 blocks the unprivileged user namespaces bubblewrap needs, so the campaign refused to run the fake cores and four FakeCorePasses tests failed, also inside the no-jsonschema replay. CI now installs bubblewrap, lifts the AppArmor restriction and proves a sandbox starts. Locally the tests name the missing sandbox instead of failing on a KeyError.

tests/test_campaign.py

@@ -900,6 +900,11 @@ class FakeCorePasses(Workspace):
 
     @classmethod
     def setUpClass(cls) -> None:
+        # These passes prove the cores run sandboxed. Without a working bwrap
+        # the campaign refuses, and the cause is named here instead of a KeyError.
+        _prefix, isolation = campaign.core_probe.sandbox_argv([Path(tempfile.gettempdir())])
+        if isolation != campaign.core_probe.SANDBOX:
+            raise unittest.SkipTest(f"no sandbox here ({isolation}): install bubblewrap")
         TMP.mkdir(parents=True, exist_ok=True)
         cls.build = Path(tempfile.mkdtemp(dir=TMP))
         source = cls.build / "fake.c"