fix(sandbox): pin and verify Node/Bun installs in agent image

Replace unverified curl | bash installers. Node now comes from a pinned
NodeSource apt repo whose packages apt verifies against a signed-by key;
Bun is downloaded as a version-pinned release artifact checked against its
SHA256 (x64 + arm64).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: amir-at-bunny

sandbox/Dockerfile

@@ -22,13 +22,31 @@ RUN apt-get update && apt-get install -y \
     && sed -i 's|#\?PermitRootLogin.*|PermitRootLogin yes|' /etc/ssh/sshd_config \
     && sed -i 's|#\?PasswordAuthentication.*|PasswordAuthentication yes|' /etc/ssh/sshd_config
 
-# Node.js (LTS)
-RUN curl -fsSL https://deb.nodesource.com/setup_lts.x | bash - \
-    && apt-get install -y nodejs \
+# Node.js (pinned NodeSource apt repo with a verified signing key — no curl | bash).
+# apt then cryptographically verifies the nodejs package against the pinned key.
+ARG NODE_MAJOR=22
+RUN install -d -m 0755 /etc/apt/keyrings \
+    && curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key \
+         -o /etc/apt/keyrings/nodesource.asc \
+    && echo "deb [signed-by=/etc/apt/keyrings/nodesource.asc] https://deb.nodesource.com/node_${NODE_MAJOR}.x nodistro main" \
+         > /etc/apt/sources.list.d/nodesource.list \
+    && apt-get update && apt-get install -y nodejs \
     && rm -rf /var/lib/apt/lists/*
 
-# Bun
-RUN curl -fsSL https://bun.sh/install | bash
+# Bun (pinned version, checksum-verified release artifact — no curl | bash).
+ARG BUN_VERSION=1.3.14
+ARG TARGETARCH
+RUN set -eux; \
+    case "${TARGETARCH:-amd64}" in \
+        amd64) BUN_ARCH=x64;       BUN_SHA256=951ee2aee855f08595aeec6225226a298d3fea83a3dcd6465c09cbccdf7e848f ;; \
+        arm64) BUN_ARCH=aarch64;   BUN_SHA256=a27ffb63a8310375836e0d6f668ae17fa8d8d18b88c37c821c65331973a19a3b ;; \
+        *) echo "unsupported architecture: ${TARGETARCH}" >&2; exit 1 ;; \
+    esac; \
+    curl -fsSL "https://github.com/oven-sh/bun/releases/download/bun-v${BUN_VERSION}/bun-linux-${BUN_ARCH}.zip" -o /tmp/bun.zip; \
+    echo "${BUN_SHA256}  /tmp/bun.zip" | sha256sum -c -; \
+    unzip -q /tmp/bun.zip -d /tmp/bun; \
+    install -Dm755 "/tmp/bun/bun-linux-${BUN_ARCH}/bun" /root/.bun/bin/bun; \
+    rm -rf /tmp/bun.zip /tmp/bun
 ENV PATH="/root/.bun/bin:$PATH"
 
 # Claude Code