Add Linux Bubblewrap sandbox

- Use `bwrap` to translate shared sandbox rules into rootless
  namespace execution.
- Gate the backend behind `HOMEBREW_SANDBOX_LINUX` while the Linux
  policy is still experimental.
- Keep macOS on its existing `sandbox-exec` path while Linux uses shared
  executable lookup for `bwrap`.
- Auto-install `bubblewrap` from `homebrew/core` when the sandbox is
  enabled and no system or usable brewed binary is found.
- Prefer a usable system `bwrap` from `ORIGINAL_PATHS` over a brewed
  one so distribution-provided binaries are used when available.
- Find brewed `bwrap` from `HOMEBREW_ORIGINAL_BREW_FILE` so integration
  subprocesses still use the Linux sandbox.
- Preserve `Sandbox#run`'s tmpdir cwd inside the `bwrap` namespace and
  suppress Linux PTY thread warnings after sandboxed children exit.
- Expose formula, Homebrew library and Linux runtime paths as read-only
  binds so sandboxed source builds can run with vendored Ruby.
- Keep synthetic test formula installs off the API so sandbox CI does
  not require network during local formula setup.
- Avoid creating optional prefix `var` directories just to configure a
  test sandbox and remove empty Linux bind placeholders after runs.
- Require a working rootless `bwrap` on GitHub Actions and install the
  system `bubblewrap` package before Linux tests run.