fix: prove Linux Agent sandbox boundary

.gitea/workflows/hub-check.yml

@@ -44,7 +44,7 @@ jobs:
         run: npm ci
 
       - name: Install Linux sandbox dependency
-        run: sudo apt-get update && sudo apt-get install --yes bubblewrap
+        run: sudo apt-get update && sudo apt-get install --yes bubblewrap socat
 
       - name: Wait for Postgres
         run: |
@@ -89,7 +89,11 @@ jobs:
           cargo install --path crates/cph-cli --locked
 
       - name: Prove real Claude SDK Bash sandbox boundary
-        run: /usr/bin/setpriv --no-new-privs npx vitest run test/integration/agent-sandbox-linux.test.ts
+        run: |
+          sudo install -d -o "$(id -u)" -g "$(id -g)" -m 0700 /var/lib/cph-test
+          CPH_SANDBOX_TEST_ROOT=/var/lib/cph-test \
+            /usr/bin/setpriv --no-new-privs \
+            npx vitest run test/integration/agent-sandbox-linux.test.ts
 
       - name: Run unit tests
         run: npx vitest run test/unit