A second (or later) invocation of a --persistent sandbox failed with:
cp: cannot create regular file '.../root/certs/openssl.cnf': Permission denied
`DEV_SANDBOX_ASSETS` is a Nix store path when the sandbox is invoked via
the `sandbox` wrapper (nix/sandbox.nix sets it to a store-copied
scripts/sandbox/ directory), and Nix store files are always mode 0444.
Plain `cp SRC DEST` opens an existing DEST for writing in place rather
than replacing it, so once one sandbox run has copied a read-only
openssl.cnf/proxy.py into a --persistent root, every subsequent run on
that same root fails trying to overwrite its own prior copy.
This silently broke every multi-invocation --persistent scenario,
including tests/install/install-update-e2e.sh's update and installer
routes (both run `install` a second time in the same persistent root).
Reproduced identically on unmodified main.
Fix: `cp -f`, which unlinks and recreates the destination instead of
writing through it, so the destination's mode never matters. Verified
by running `sandbox install --persistent -- --skip-setup --skip-browser`
twice against the same root -- second run failed before this change,
passes after.
2b2c1d9b3a