fix(smoke): disable WebKit sandbox in headless CI smoke runs

WebKitGTK spawns its WebProcess inside a bubblewrap sandbox that
requires CAP_NET_ADMIN for network namespace setup. GitHub Actions
runners lack this capability, so the WebProcess crashes on startup
with RTM_NEWADDR: Operation not permitted, which surfaces as a
fatal readPIDFromPeer GLib error that kills the smoke run.

Constraint: GitHub Actions ubuntu-latest runners do not grant CAP_NET_ADMIN
Rejected: Skip WebView creation in smoke mode | defeats the purpose of exercising real startup
Rejected: Add --cap-add SYS_ADMIN to the CI container | overly broad privilege escalation for a test-only need
Confidence: high
Scope-risk: narrow
Directive: WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS is CI-only; do not propagate it to user-facing launchers
Tested: manual review of bwrap / readPIDFromPeer crash sequence in CI logs
Not-tested: Full GitHub release-assets workflow rerun

Author: OneNoted

scripts/headless-smoke.sh

@@ -11,5 +11,6 @@ timeout "${TIMEOUT_SECONDS:-20}" \
   LIBGL_ALWAYS_SOFTWARE=1 \
   GTK_USE_PORTAL=0 \
   NO_AT_BRIDGE=1 \
+  WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS=1 \
   xvfb-run -a \
   "$@"