fix(release): allow Chromium sandbox in prerelease E2E

[lefarcen]

Why

The release team hit repeated prerelease failures after the browser-clone coverage began launching the installed Chromium directly from the daemon. GitHub's Ubuntu 24.04 runners restrict unprivileged user namespaces through AppArmor, so Chromium exited with No usable sandbox! before the E2E assertion could exercise the product.

This blocked otherwise healthy release/v0.20.0 builds and caused the Feishu release card to report a packaging failure. The runner should permit Chromium's real sandbox for this test instead of weakening production browser flags with --no-sandbox.

What users will see

Prerelease builds can complete their daemon browser E2E gate and continue to macOS/Windows packaging on GitHub-hosted Ubuntu runners. Product and packaged-runtime behavior is unchanged.

Surface area

• UI — new page / dialog / panel / menu item / setting / empty state in apps/web or apps/desktop (including Electron menu bar)
• Keyboard shortcut — new or changed
• CLI / env var — new od subcommand or flag, new tools-dev / tools-pack flag, or new OD_* env var
• API / contract — new /api/* endpoint, new SSE event, or changed shape in packages/contracts
• Extension point — new entry under skills/, design-systems/, design-templates/, or craft/, or change to the skills protocol
• i18n keys — added new translation keys (see TRANSLATIONS.md for the locale workflow)
• New top-level dependency — adding any new entry to the root package.json (dependencies or devDependencies); workspace-package package.json files are out of scope. Include a paragraph on what we get vs. what bytes we ship (see CONTRIBUTING.md → Code style)
• Default behavior change — changes what existing users experience without opting in (default model, default setting, file/SQLite schema, auto-network on startup, auto-install)
• None — internal refactor, docs, tests, or translation update only

Screenshots

Not applicable; this only changes the ephemeral prerelease E2E runner.

Bug fix verification

• Test path: e2e/tests/packaged-smoke-workflow.test.ts
• The topology assertion was added first and failed against the pre-fix workflow, then passed after the runner step was added.
• The assertion also prevents replacing the sandbox with --no-sandbox and pins the sysctl step before E2E execution.

Validation

• pnpm --filter @open-design/e2e test tests/packaged-smoke-workflow.test.ts — 70 passed, 1 skipped
• pnpm guard
• pnpm typecheck
• git diff origin/main...HEAD --check
• Full release workflow: https://github.com/nexu-io/open-design/actions/runs/32153926636 — 20 jobs succeeded, including E2E Vitest, all P0 UI groups, macOS ARM64/x64 builds and smoke tests, Windows x64 build, publish, and Feishu notification
• Published Open Design Prerelease 0.20.0-prerelease.8 from release/v0.20.0 at commit 57b4b9650304bee39066b1374a7bdc121b4e82bb

[nettee]

@lefarcen

I reviewed both changed ranges. The prerelease E2E job now conditionally relaxes Ubuntu 24.04's AppArmor user-namespace restriction only when the sysctl is available, preserving Chromium's real sandbox and failing fast if the required write is rejected. The topology test pins the step before E2E and guards against --no-sandbox.

Verification: pnpm --filter @open-design/e2e test tests/packaged-smoke-workflow.test.ts (70 passed, 1 skipped), actionlint -color .github/workflows/release-prerelease.yml, pnpm guard, pnpm typecheck, and git diff --check.

Nice, focused fix—thanks for documenting the security intent and keeping the production browser flags untouched.

_{🔁 Powered by Looper · runner=reviewer · agent=codex · An autonomous AI dev team for your GitHub repos.}

[github-actions]

Visual regression review

Head: c536744 · Base: aa5bb5d

0 changed · 49 unchanged · 0 new without baseline · 0 failed

Unchanged cases

Case	Main	PR	Diff
visual-avatar-local-agent-list 0 px (0.00%)
visual-avatar-local-agent-list-panel 0 px (0.00%)
visual-avatar-menu 0 px (0.00%)
visual-avatar-menu-panel 0 px (0.00%)
visual-avatar-open-design-model-picker 0 px (0.00%)
visual-critical-settings 0 px (0.00%)
visual-critical-workspace 0 px (0.00%)
visual-critical-workspace-preview 0 px (0.00%)
visual-design-system-detail 0 px (0.00%)
visual-design-systems 0 px (0.00%)
visual-home 0 px (0.00%)
visual-home-catalog 0 px (0.00%)
visual-home-context-picker 0 px (0.00%)
visual-home-context-picker-popover 0 px (0.00%)
visual-home-plugin-filter 0 px (0.00%)
visual-home-plugin-use-staged 0 px (0.00%)
visual-home-plugin-use-with-query 0 px (0.00%)
visual-home-staged-attachment 0 px (0.00%)
visual-integrations 0 px (0.00%)
visual-integrations-mcp 0 px (0.00%)

Visual diff is advisory only and does not block merging.

[nettee]

@lefarcen

I reviewed all four changed files, including the srcDoc probe cancellation/restart paths and the prerelease E2E workflow's conditional AppArmor sysctl step. Verification: pnpm --filter @open-design/web exec vitest run tests/components/FileViewer.test.tsx (275 passed), pnpm --filter @open-design/e2e test tests/packaged-smoke-workflow.test.ts (70 passed, 1 skipped), actionlint, pnpm guard, pnpm typecheck, web typecheck, and git diff --check; the live PR checks are green as well.

This is a focused fix that preserves Chromium's real sandbox and closes stale timer races; thanks for pairing the lifecycle changes with regression coverage.

_{🔁 Powered by Looper · runner=reviewer · agent=codex · An autonomous AI dev team for your GitHub repos.}