fix(desktop): filter --no-sandbox from CLI arg parsing on Linux

The Linux wrapper injects --no-sandbox for Electron sandboxing, but
the CLI parser was treating it as an unknown Paseo option. Filter it
out alongside the existing macOS -psn_ prefix.

packages/desktop/src/daemon/node-entrypoint-launcher.test.ts

@@ -32,6 +32,26 @@ describe("node-entrypoint-launcher", () => {
       ).toBeNull();
     });
 
+    it("ignores --no-sandbox injected by Linux wrapper", () => {
+      expect(
+        parseCliPassthroughArgsFromArgv({
+          argv: ["/usr/bin/Paseo", "--no-sandbox", "status"],
+          isDefaultApp: false,
+          forceCli: false,
+        }),
+      ).toEqual(["status"]);
+    });
+
+    it("returns null when only --no-sandbox is present", () => {
+      expect(
+        parseCliPassthroughArgsFromArgv({
+          argv: ["/usr/bin/Paseo", "--no-sandbox"],
+          isDefaultApp: false,
+          forceCli: false,
+        }),
+      ).toBeNull();
+    });
+
     it("preserves CLI flags for direct app invocations", () => {
       expect(
         parseCliPassthroughArgsFromArgv({

packages/desktop/src/daemon/node-entrypoint-launcher.ts

@@ -1,4 +1,4 @@
-const IGNORED_GUI_LAUNCH_ARG_PREFIX = "-psn_";
+const IGNORED_ARG_PREFIXES = ["-psn_", "--no-sandbox"];
 
 export const DESKTOP_CLI_ENV = "PASEO_DESKTOP_CLI";
 
@@ -44,7 +44,7 @@ export function parseCliPassthroughArgsFromArgv(
   const startIndex = input.isDefaultApp ? 2 : 1;
   const effective = input.argv
     .slice(startIndex)
-    .filter((arg) => !arg.startsWith(IGNORED_GUI_LAUNCH_ARG_PREFIX));
+    .filter((arg) => !IGNORED_ARG_PREFIXES.some((p) => arg.startsWith(p)));
 
   if (input.forceCli) {
     return effective;