ci(bun-test): 给 bun-test 腿补上 bubblewrap 安装步骤

`test` 腿有一步 best-effort 安装 bubblewrap 并放开 userns 限制，
`bun-test` 腿没有。job 之间不共享文件系统，所以这一步必须各写各的，
否则 bun-test 完全靠 runner 镜像自带 bwrap——抽到不带的就红。

后果不只是"少测了点东西"，而是**红得像代码回归**：bwrap 缺席时
`prepareDirectSandbox()` 返回 null，test/sandbox-shim-compiled-form.test.ts
里的 `overlayTargets()` 直接返回 `[]`，4 个断言 `toEqual([launcher])` 必挂。

⚠️ 与 vitest 不同，`bun test` 这边没有宿主级 skip gate：那组用例的
`describe.skipIf` 只挡非 linux，在 linux runner 上照跑，bwrap 一缺就只能失败。

实测：
- 同一段 commit 范围的两次 CI，一次日志里 `bwrap missing` 出现 5 次并失败，
  另一次 0 次并通过——同代码同 job 定义，差的只是 runner 状态
- 本机对照：bwrap 可用 17 pass / 0 fail；把 bwrap 从子进程 PATH 藏掉
  13 pass / 4 fail（与 CI 失败形态逐字一致）
- 该失败与 bun 版本无关：1.4.1 与 1.4.2 在藏掉 bwrap 时同样 13/4
- 步骤内容与 `test` 腿的那份逐字节相同（yaml 解析后对比 IDENTICAL）

注意这**不能让 bun-test 必然全绿**：该腿另有一个独立成因，
test/tmux-startup-storm-recovery.test.ts 会撞 720s 单文件墙被 SIGKILL
（master 738da7f 上 bwrap 正常仍因它单独红）。那个另算，不在本 PR 范围。

Author: deepcoldy

.github/workflows/ci.yml

@@ -144,6 +144,30 @@ jobs:
         with:
           node-version: 22
 
+      # Same step as the `test` job above (it moved there with the 3-way unit
+      # shard, #1288), repeated because jobs share no filesystem. WITHOUT IT this
+      # leg is a runner lottery: `prepareDirectSandbox()`
+      # returns null when bwrap is missing, so `overlayTargets()` in
+      # test/sandbox-shim-compiled-form.test.ts yields [] and 4 cases fail on an
+      # image that happens not to ship bubblewrap — MEASURED on two runs of the
+      # same commit range, one printing `bwrap missing` 5 times and failing, the
+      # other printing it 0 times and passing. The failures look like a code
+      # regression and are not one, which is the expensive part.
+      #
+      # ⚠️ Unlike vitest, `bun test` has no host-level skip gate here: the suite
+      # under `describe.skipIf(process.platform !== 'linux')` DOES run on this
+      # linux runner and can only fail once bwrap is absent. Keep this step in
+      # sync with the `test` job's copy.
+      - name: Enable bwrap sandbox for integration tests (best-effort)
+        run: |
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
+          command -v bwrap >/dev/null || sudo apt-get install -y bubblewrap || true
+          if bwrap --bind / / --unshare-user -- /bin/true 2>/dev/null; then
+            echo "bwrap userns OK — sandbox integration tests will run for real"
+          else
+            echo "bwrap still unavailable — sandbox integration tests will skip (see test-side gate)"
+          fi
+
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: 1.4.1