Prevent destructive apt sandbox installs

[cursor]

Summary

• simulate Eve apt dependency installs before making changes
• abort when apt proposes package removals or the safety check fails
• bump the Eve bootstrap revision so cached environments apply the corrected bootstrap
• add regression coverage for destructive, safe, and failed-check plans

Validation

• pnpm --filter @agent-browser/sandbox test
• git diff --check