fix: restore Linux chrome-sandbox postinstall (#6133)

* fix: restore linux chrome sandbox postinstall

Co-authored-by: Orca <help@stably.ai>

* fix: check unprivileged user namespaces for sandbox

Co-authored-by: Orca <help@stably.ai>

* fix: always repair linux chrome sandbox permissions

Co-authored-by: Orca <help@stably.ai>

---------

Co-authored-by: Orca <help@stably.ai>

config/scripts/package-electron-runtime-contract.test.mjs

@@ -101,6 +101,17 @@ describe('Electron runtime package contract', () => {
     expect(publishLinuxStep.with.command).toBe('${{ matrix.release_command }}')
   })
 
+  it('keeps Linux postinstall repairing Chromium sandbox permissions', () => {
+    const afterInstallScript = readFileSync(
+      join(projectDir, 'resources/linux/packaging/after-install.sh'),
+      'utf8'
+    )
+
+    expect(afterInstallScript).toContain('chrome-sandbox')
+    expect(afterInstallScript).toContain('chmod 4755 "$sandbox"')
+    expect(afterInstallScript).not.toContain('chmod 0755 "$sandbox"')
+  })
+
   it('lets release-cut tag a version that is already present on main', () => {
     const releaseWorkflow = readFileSync(
       join(projectDir, '.github/workflows/release-cut.yml'),

resources/linux/packaging/after-install.sh

@@ -12,6 +12,13 @@ set -e
 link="/usr/bin/orca-ide"
 
 for dir in /opt/Orca /opt/orca-ide /opt/orca; do
+  sandbox="$dir/chrome-sandbox"
+  if [ -f "$sandbox" ]; then
+    # Why: packaged Linux installs must leave Chromium's sandbox helper usable
+    # on hosts where unprivileged user namespaces are unavailable.
+    chmod 4755 "$sandbox" || true
+  fi
+
   shim="$dir/resources/bin/orca-ide"
   if [ -x "$shim" ]; then
     # Only manage our own symlink; never clobber an unrelated /usr/bin/orca-ide.