Try ubuntu-latest with a hack for CI

.github/workflows/compile-check-blink.yml

@@ -8,14 +8,36 @@ on:
       - 'README.md'
 jobs:
   nix-flake-check:
-    runs-on: ubuntu-22.04  # Work around https://github.com/containers/bubblewrap/issues/632
+    runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
     - uses: cachix/install-nix-action@v29
       with:
         github_access_token: ${{ secrets.GITHUB_TOKEN }}
     - uses: DeterminateSystems/magic-nix-cache-action@v8
 
+    - name: AppArmor fixes
+      # Work around https://github.com/containers/bubblewrap/issues/632
+      run: |
+        arduino_cli_path="$(nix develop --command which arduino-cli)"
+        bwrap_path="$(grep '/bwrap' /nix/store/z2afvf8vnczxd09xpcc6nkn0zd83nacl-arduino-cli-1.0.4/bin/arduino-cli)"
+
+        sudo cat <<EOF > /etc/apparmor.d/local-bwrap
+        abi <abi/4.0>,
+        include <tunables/global>
+
+        profile local-bwrap ${bwrap_path} flags=(unconfined) {
+          userns,
+
+          # Site-specific additions and overrides. See local/README for details.
+          include if exists <local/bwrap>
+        }
+        EOF
+
+        sudo cat /etc/apparmor.d/local-bwrap
+
+        sudo systemctl reload apparmor
+
     - name: Compile test
       run: |
         nix develop --command make -C blink compile