bump(sys-apps/sandbox): sync with upstream