Install Bubblewrap on hosted Ubuntu

- Avoid forcing taps to disable Linux sandboxing on GitHub Actions
- Use Ubuntu's `bubblewrap` package before the Homebrew fallback
- Keep self-hosted and non-Ubuntu runners on the existing path