fix(sandbox): stabilize desktop Chrome launcher trust and align runtime image layers

[rcyw]

Summary

This PR stabilizes desktop Chrome behavior in the sandbox and aligns runtime layering/docs with current product usage.

What changed

• apps/client
  • Recreate existing sandbox container when requested image ID changes (even if image tag text is unchanged).
• docker/desktop/runtime-dev
  • Move Chrome launcher/policy/autostart setup to dedicated config files.
  • Add launcher trust repair scripts (deck-fix-chrome-launcher, deck-patch-xinitrc).
  • Enforce keyring-safe defaults (--password-store=basic) and disable Chrome password manager via managed policy.
  • Add runtime-dev README documenting rationale, verification, and troubleshooting.
• docker/desktop/runtime-ai
  • Slim default AI tooling to OpenCode-only.
  • Update run output and README to reflect OpenCode-first scope.
• packages/computer-use
  • Refactor process startup syscall/credential setup into processSysProcAttr (no intended behavior change).
• docs
  • Update sandbox/runtime docs for layer responsibility consistency.
  • Update CHANGELOG Unreleased section.

Why

• Fix repeated Untrusted application launcher prompts in XFCE/noVNC desktop sessions.
• Avoid Chrome keyring/password-store interruptions in containerized usage.
• Reduce default image size/time by removing currently unused AI CLIs from default runtime-ai layer.
• Ensure local client reuses/recreates containers correctly when image content changes behind same tag.

Validation

• go test ./... in packages/computer-use
• cargo check in apps/client/src-tauri
• Rebuilt images and verified container file parity for:
  • /usr/local/bin/deck-fix-chrome-launcher
  • /etc/profile.d/deck-google-chrome.sh
  • /home/deck/Desktop/google-chrome.desktop
  • /etc/opt/chrome/policies/managed/deck-sandbox.json
  • /etc/xdg/autostart/deck-fix-chrome-launcher.desktop
  • /etc/xdg/xfce4/xinitrc hook injection

[cursor]

You have run out of free Bugbot PR reviews for this billing cycle. This will reset on April 16.

To receive reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.