Fix Linux Bubblewrap setup

- Prefer an existing `bubblewrap` before installing anything.
- Use Homebrew before `apt-get` so local and container installs stay
  consistent.
- Keep `apt-get` as a final GitHub-hosted Ubuntu fallback for missing
  or unusable `bwrap` executables.
- Symbolise API dependency bounds before runtime casts so the
  Homebrew fallback can load `bubblewrap` from API data.
- Document the temporary `test-bot` default until Linux sandboxing is
  forced on in a later release.