Fix sandbox installation broken by 6b3aa671

1. $(DESTDIR) must always be used because installation may be done to
the subroot path.
2. chown must never be done on install phase. Program may be
installed by unpriviledged user into private directory.