fix(updater): skip apt's _apt sandbox notice in the Linux .deb install command (#35643)

The copied .deb install command now passes
-o Binary::file::APT::Sandbox::User=root to apt. The _apt sandbox user
can't read the package in the user's private ~/.cache, so apt already
fell back to root and printed an "unsandboxed as root" notice; presetting
that fallback for the file: method removes the notice without changing
effective privilege, and network methods stay sandboxed.

Fixes #35641

Co-authored-by: Neil <neil@stably.ai>

docs/site/content/docs/install.mdx

@@ -108,7 +108,7 @@ The AppImage has a stable download link per architecture — [`orca-linux.AppIma
 **The `.deb` and `.rpm` do not self-update.** Orca still notices the new version and downloads the package, then gives you a **Copy Install Command** button. Copy it rather than retyping it: Orca resolves every program to an absolute path in a trusted system directory and single-quotes the package path, so what you paste looks like this:
 
 ```
-/usr/bin/sudo /usr/bin/apt install -- '/home/you/.cache/orca-updater/pending/orca-ide_1.4.194_amd64.deb'
+/usr/bin/sudo /usr/bin/apt -o Binary::file::APT::Sandbox::User=root install -- '/home/you/.cache/orca-updater/pending/orca-ide_1.4.194_amd64.deb'
 ```
 
 Which package manager appears depends on what your system actually has: `apt`, else `dpkg -i`, for a `.deb`; `zypper`, `dnf`, `yum`, then `rpm -Uvh` for an `.rpm`. The download directory follows `XDG_CACHE_HOME` when that is set and falls back to `~/.cache` when it is not.

src/main/linux-package-install-command.test.ts

@@ -168,7 +168,8 @@ describe('buildLinuxPackageInstallCommand', () => {
     const { buildLinuxPackageInstallCommand } = await loadCommandModule()
     expect(buildLinuxPackageInstallCommand('deb', '/tmp/orca.deb')).toEqual({
       ok: true,
-      command: "/usr/bin/sudo /usr/bin/apt install -- '/tmp/orca.deb'"
+      command:
+        "/usr/bin/sudo /usr/bin/apt -o Binary::file::APT::Sandbox::User=root install -- '/tmp/orca.deb'"
     })
   })
 
@@ -246,7 +247,7 @@ describe('buildLinuxPackageInstallCommand', () => {
     const { buildLinuxPackageInstallCommand } = await loadCommandModule()
     expect(buildLinuxPackageInstallCommand('deb', "/tmp/a b'; id #.deb")).toEqual({
       ok: true,
-      command: `/usr/bin/sudo /usr/bin/apt install -- '/tmp/a b'"'"'; id #.deb'`
+      command: `/usr/bin/sudo /usr/bin/apt -o Binary::file::APT::Sandbox::User=root install -- '/tmp/a b'"'"'; id #.deb'`
     })
   })
 })

src/main/linux-package-install-command.ts

@@ -7,7 +7,8 @@ import type { LinuxRootPackageType } from '../shared/update-status-types'
 const TRUSTED_EXECUTABLE_DIRECTORIES = ['/usr/bin', '/bin', '/usr/sbin', '/sbin']
 
 const DEB_PACKAGE_MANAGERS: { name: string; args: string[] }[] = [
-  { name: 'apt', args: ['install', '--'] },
+  // Preset apt's own root fallback for file: reads (_apt can't read ~/.cache); network methods stay sandboxed.
+  { name: 'apt', args: ['-o', 'Binary::file::APT::Sandbox::User=root', 'install', '--'] },
   { name: 'dpkg', args: ['-i', '--'] }
 ]