The terminal job only needs the Ink TUI, not every workspace (desktop/electron). The e2e-upgrade bwrap check used different flags from _bwrap_usable (no --proc, no --die-with-parent), so it could pass while the suite fell back to running the real updater unsandboxed; it now asserts _helpers.BWRAP_OK itself.