Sandbox: mount /lib64 in the bubblewrap start-up check

On x86_64 the dynamic loader lives in /lib64, so the probe failed with
"execvp /bin/true: No such file or directory" and shell commands of non-admin
users were disabled on amd64 hosts. The sandbox itself already mounted it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -3,6 +3,13 @@
 All notable changes to CodeCraft. Versions follow [Semantic Versioning](https://semver.org/);
 until 1.0, minor versions may contain breaking changes.
 
+## [Unreleased]
+
+### Fixed
+
+- **Sandbox on x86_64:** the start-up check of bubblewrap did not mount `/lib64`, so it failed
+  on amd64 hosts and shell commands of non-admin users were disabled.
+
 ## [v202611-00008] – 2026-11-09
 
 ### Added

server/src/sandbox.rs

@@ -37,6 +37,8 @@ pub async fn probe() -> Result<(), String> {
     }
     let res = match Command::new("bwrap")
         .args(["--ro-bind", "/usr", "/usr", "--ro-bind", "/bin", "/bin", "--ro-bind", "/lib", "/lib", "--dev", "/dev", "--proc", "/proc"])
+        // The dynamic loader lives in /lib64 on x86_64 (/lib on arm64).
+        .args(["--ro-bind-try", "/lib64", "/lib64", "--ro-bind-try", "/lib32", "/lib32"])
         .args(["--unshare-all", "--die-with-parent", "--clearenv", "/bin/true"])
         .env_clear()
         .output()