Add Linux Bubblewrap sandbox

[MikeMcQuaid]

• Use bwrap to translate shared sandbox rules into rootless namespace execution.
• Gate the backend behind HOMEBREW_SANDBOX_LINUX while the Linux policy is still experimental.
• Reuse preinstall diagnostics to tell opt-in users when bubblewrap is missing.
• Install bubblewrap in Linux CI and Docker images so test-bot exercises the sandbox path.

---

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same change?
• Have you added an explanation of what your changes do and why you'd like us to include them? Performance claims (e.g. "this is faster") must include Hyperfine benchmarks.
• Have you written new tests (excluding integration tests) for your changes? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) with your changes locally?

---

• AI was used to generate or assist with generating this PR. Please specify below how you used AI to help you, and what steps you have taken to manually verify the changes. Non-maintainers may only have one AI-assisted/generated PR open at a time.

OpenAI Codex 5.5 xhigh with manual review, (unit not Linux) testing and tweaking.

---

[p-linnane]

Love it!!!