fix(sandbox-doctor): atomic git-shim patch, :99-socket Xvfb check, dnf gate, non-interactive sudo

- The /conductor/bin/git patch writes tmp-then-rename with a .orig backup —
  a concurrently spawned git can never exec a truncated shim.
- Xvfb running-check looks for the :99 socket, not any-display pgrep.
- Xvfb install is dnf-gated so non-dnf distros degrade to a warning instead
  of aborting the remaining fixes under set -eu.
- The bashrc /dev/fd restore uses sudo -n || true — no password prompt at
  every shell start on non-passwordless machines.
- BASH_COMPAT=50 keeps heredoc bodies off the bash pipe window.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/sandbox-doctor-shell.test.ts

@@ -27,7 +27,8 @@ describe('sandbox-doctor.sh', () => {
     expect(src).toContain('[ ! -e /dev/fd ]');                       // /dev/fd restore
     expect(src).toContain('git config --global user.name >/dev/null 2>&1 ||'); // never clobber identity
     expect(src).toContain("grep -q 'GSTACK sandbox test env'");      // bashrc seeded once
-    expect(src).toContain('command -v Xvfb >/dev/null 2>&1 ||');     // install only if absent
+    expect(src).toContain('if ! command -v Xvfb >/dev/null 2>&1');   // install only if absent, dnf-gated
+    expect(src).toContain('[ ! -e /tmp/.X11-unix/X99 ]');            // :99 socket check, not any-display pgrep
     expect(src).toContain('[ "${shm_kb:-0}" -gt 0 ]');               // missing /dev/shm: skip, not a set -eu abort
   });
 });