d59b7e1dff
The GitHub Ubuntu runner disables unprivileged user namespaces with AppArmor, so Chrome's sandbox cannot initialize and the new secure default (sandbox on) makes Chrome refuse to start. IN_DOCKER is the documented escape hatch for that case, so set it on the Ubuntu leg of the test job. It also exercises the container code path. macOS does not need the flag, so it stays empty there.