fix(sandbox): switch to root user for package installation in sandbox-common-setup

The base image (Dockerfile.sandbox) sets USER sandbox at the end, so
when sandbox-common-setup.sh builds FROM it, apt-get runs as the
unprivileged sandbox user and fails with 'Permission denied'.

Add USER root before apt-get/npm/curl install steps, and restore
USER sandbox at the end to preserve the non-root runtime default.

Fixes #16420

scripts/sandbox-common-setup.sh

@@ -27,6 +27,7 @@ docker build \
   --build-arg BREW_INSTALL_DIR="${BREW_INSTALL_DIR}" \
   - <<EOF
 FROM ${BASE_IMAGE}
+USER root
 ENV DEBIAN_FRONTEND=noninteractive
 ARG INSTALL_PNPM=1
 ARG INSTALL_BUN=1
@@ -55,6 +56,7 @@ RUN if [ "\${INSTALL_BREW}" = "1" ]; then \\
   if [ ! -x "\${BREW_INSTALL_DIR}/bin/brew" ]; then echo "brew install failed"; exit 1; fi; \\
   ln -sf "\${BREW_INSTALL_DIR}/bin/brew" /usr/local/bin/brew; \\
 fi
+USER sandbox
 EOF
 
 cat <<NOTE