chore(cask): update sbx to v0.25.0

[docker-read-write]

Automated update from Docker Sandboxes release workflow.

Version: v0.25.0
SHA256 (darwin-arm64): 4c8ba31df9bdfa469cacef28f92e52ef370cac9df8020d578e26111518a3d3ce

Changes:

• Updated Casks/sbx.rb (latest)
• Added Casks/sbx@0.25.0.rb (pinned)

Release Notes

Highlights

This release introduces upstream proxy support for routing sandbox traffic through corporate proxies, a --cpus flag for controlling sandbox CPU allocation, and PID file-based daemon recovery so sbx daemon stop works even when the daemon socket is unresponsive. Linux users also get native package manager update prompts via apt and dnf.

What's New

CLI

• Add --cpus flag to create and run commands for sandbox CPU allocation (#2257)
• Add apt and dnf update prompts for Linux installations (#2118)
• Expand OAuth secret ls/rm handling for Anthropic (#2192)
• Hint users to use sbx run <agent> for unknown agent commands (#2225)
• Return non-zero exit code when user cancels prompts (#2237)

Daemon

• Add PID file fallback for daemon stop when socket is unresponsive, with platform-specific identity verification (#2199, #2282)
• Add daemon OAuth reload endpoint and harden Codex token sync (#2181)
• Recover from analytics kit panic during shutdown (#2233)
• Fail daemon startup if mount policy engine cannot be created (#2228)

Networking

• Add upstream proxy support for routing sandbox traffic through corporate proxies (#2059)
• Guard against nil req.URL in OAuth URL matcher (#2252)
• Log allow decisions at DEBUG level, deny at INFO (#2270)
• Wait for proxy goroutines to exit during teardown (#2235)

Governance

• Show rule origin and status for policykit rules (#2246)
• Skip mount policy eviction when default rules are not set (#2227)