Align sandbox integration tests with rootless AWF command default

pkg/workflow/sandbox_agent_false_test.go

@@ -106,9 +106,9 @@ Test workflow to verify sandbox.agent: awf enables firewall.
 
 		lockStr := string(lockContent)
 
-		// Verify that AWF installation IS present
-		if !strings.Contains(lockStr, "sudo -E awf") {
-			t.Error("Expected AWF firewall to be enabled, but did not find 'sudo -E awf' command in lock file")
+		// Verify that AWF installation IS present (rootless by default)
+		if !strings.Contains(lockStr, "awf --config ") {
+			t.Error("Expected AWF firewall to be enabled, but did not find rootless 'awf --config' command in lock file")
 		}
 	})
 
@@ -153,8 +153,8 @@ Test workflow to verify default sandbox.agent behavior (awf).
 		lockStr := string(lockContent)
 
 		// With network restrictions and no sandbox config, firewall should be enabled by default
-		if !strings.Contains(lockStr, "sudo -E awf") {
-			t.Error("Expected firewall to be enabled by default with network restrictions, but did not find 'sudo -E awf' command in lock file")
+		if !strings.Contains(lockStr, "awf --config ") {
+			t.Error("Expected firewall to be enabled by default with network restrictions, but did not find rootless 'awf --config' command in lock file")
 		}
 	})
 }

pkg/workflow/sandbox_agent_tools_default_test.go

@@ -261,8 +261,8 @@ Test workflow where firewall is auto-enabled via network restrictions.
 		// Verify that bash tool is present
 		assert.Contains(t, lockStr, "bash", "Expected bash tool to be enabled when firewall is auto-enabled")
 
-		// Verify AWF is present
-		assert.Contains(t, lockStr, "sudo -E awf", "Expected AWF to be present when auto-enabled")
+		// Verify AWF is present (rootless by default)
+		assert.Contains(t, lockStr, "awf --config ", "Expected rootless AWF invocation to be present when auto-enabled")
 	})
 }