v1.24.0

Add "probe" value to linux.noSandbox option.

"probe" is now the default behavior: at runtime, it detects whether the host supports Linux user namespaces (unshare -Ur) and only passes --no-sandbox when they are not available. Set noSandbox: true to always pass --no-sandbox (previous default behavior), or noSandbox: false to never pass it.

Fix CLI release metadata so Changesets can prepare releases that include CLI updates.