Fix AppImage owned runtime sandbox argument injection

[ymichael]

Human comments

What was wrong

Electron Builder's maintained AppImage AppRun prepends --no-sandbox when an unprivileged user namespace probe fails. The desktop re-enters its AppImage with ELECTRON_RUN_AS_NODE=1 to start the owned bb-app bridge, so that Electron-only fallback became a Node option and Node exited with code 9 after owned-runtime.json was written but before readiness. User-namespace availability made the failure intermittent in CI. The startup error path rendered the buffered child output in the window but did not write it to stderr, so the package smoke reported only that the owned PID died and hid /tmp/.mount_*/bb: bad option: --no-sandbox.

What changed

• Put Node's -- end-of-options marker and an AppRun-visible --no-sandbox sentinel after the AppImage bridge bootstrap. AppRun now leaves the invocation alone, Node treats the sentinel as data, and the bridge path remains in the owned process command.
• Write startup error details and buffered child output through the desktop logger before rendering the error view, so package-smoke stderr contains the actual child failure.
• Add a Linux regression test with an AppRun fixture that reproduces the fallback injection deterministically.

There is no host-daemon wire change, so HOST_DAEMON_PROTOCOL_VERSION is unchanged. This does not change a timeout, retry, port, readiness assertion, process-ownership check, FUSE behavior, or GUI sandbox policy.

How you verified

• Verified clean merge base ab8e0a202c70525c3c935733300198dac617e3de for HEAD, origin/main, and merge-base before investigation.
• Audited the complete failed logs for runs 33619578008 and 33567665395, both post-marker exits with no runtime failure text in captured stderr, and ruled out the already-merged port-reclaim and legacy-FUSE SIGTRAP fixes.
• On a bounded x86_64 Lima VM on Intel host host_nwqfteeqz4, a current-main AppImage reproduced the exact smoke signature. The added logging exposed exit code 9 and /tmp/.mount_*/bb: bad option: --no-sandbox; the extracted generated AppRun showed the user-namespace-dependent fallback that injected it.
• Red: pnpm exec turbo run test --filter=@bb/desktop --concurrency=2 -- --run test/bb-process.test.ts failed the new fixture before the launch fix with /usr/bin/node: bad option: --no-sandbox (8 passed, 1 failed).
• Green: the same focused Linux command passed all 9 tests after the fix.
• pnpm exec turbo run desktop:build:linux --filter=@bb/desktop --concurrency=2 passed (14/14 Turbo tasks).
• xvfb-run -a pnpm exec turbo run smoke:appimage-lifecycle --filter=@bb/desktop --force --concurrency=2 passed against the rebuilt AppImage in 30.129s, including separate GUI-mount removal and healthy owned-runtime-mount assertions.
• pnpm exec turbo run typecheck --filter=@bb/desktop --concurrency=2 passed (3/3 Turbo tasks).
• pnpm exec turbo run build --filter=@bb/desktop --concurrency=2 passed (13/13 Turbo tasks).
• pnpm exec turbo run test --filter=@bb/desktop --concurrency=2 reached 246 passing tests and 2 platform skips; the unrelated real-Electron preload smoke alone missed its existing fixed 15-second readiness ceiling on the Intel host. No timeout was changed or rerun used as evidence.
• pnpm exec oxfmt apps/desktop/src/bb-process.ts apps/desktop/src/main.ts apps/desktop/test/bb-process.test.ts --check and git diff --check passed.
• After each Linux smoke, process, FUSE mount, and smoke-temp checks were empty. The isolated VM and its guest-local source, AppImages, build outputs, and traces were deleted; final Lima, process, and mount checks were empty.

AGENT GENERATED: by GPT-5.6-Sol