fix(zed): prevent sandbox confirmation prompts

[chocobar]

Summary

• keep bubblewrap non-setuid in the desktop image
• pin fix(sandbox): find usable bubblewrap on PATH zed#76
• configure Zed agents with sandbox_permissions.allow_unsandboxed=true
• enforce the managed permission during settings synchronization

Verification

• focused external-agent, settings-sync-daemon, and server Go tests
• ./stack rebuild frontend api on Prime
• ./stack build-sandbox on Prime
• fresh native Zed session ran git add and git commit with no Awaiting Confirmation prompt
• git diff --check