fix(release): allow Chromium sandbox in prerelease E2E

Author: lefarcen

.github/workflows/release-prerelease.yml

@@ -247,6 +247,17 @@ jobs:
         run: pnpm install --frozen-lockfile
       - name: Setup Playwright
         run: pnpm -C e2e exec playwright install --with-deps chromium
+      # Ubuntu 24.04 restricts unprivileged user namespaces through AppArmor.
+      # The daemon launches the installed Chromium directly instead of through
+      # Playwright. Restore user namespaces on this ephemeral runner so the real
+      # Chromium sandbox remains enabled rather than disabling that protection.
+      - name: Allow Chromium user namespaces on GitHub Ubuntu
+        shell: bash
+        run: |
+          set -euo pipefail
+          if sysctl kernel.apparmor_restrict_unprivileged_userns >/dev/null 2>&1; then
+            sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+          fi
       - name: Prebuild workspace type declarations
         run: |
           pnpm --filter @open-design/daemon build

e2e/tests/packaged-smoke-workflow.test.ts

@@ -1549,6 +1549,11 @@ process.stdin.on("end", () => {
     expect(e2eVitestGate).toContain("needs: metadata");
     expect(e2eVitestGate).toContain("ref: ${{ needs.metadata.outputs.commit }}");
     expect(e2eVitestGate).toContain("playwright install --with-deps chromium");
+    expect(e2eVitestGate).toContain("Allow Chromium user namespaces on GitHub Ubuntu");
+    expect(e2eVitestGate).toContain("kernel.apparmor_restrict_unprivileged_userns=0");
+    expect(e2eVitestGate).not.toContain("--no-sandbox");
+    expect(e2eVitestGate.indexOf("kernel.apparmor_restrict_unprivileged_userns=0"))
+      .toBeLessThan(e2eVitestGate.indexOf("pnpm --filter @open-design/e2e test"));
     expect(e2eVitestGate).toContain("pnpm --filter @open-design/e2e test");
 
     const daemonGate = sectionBetween(prerelease, "  daemon_unit_tests:", "  verify:");