docs: host run sheet section 4, the apt-get download W: line as root is expected, and the profile's sha256 is checked again at /etc/apparmor.d (mos-1168)

docs/guides/host-run-sheet.md

@@ -106,11 +106,17 @@ apt-get download apparmor-profiles=4.0.1really4.0.1-0ubuntu0.24.04.9
 dpkg-deb --fsys-tarfile apparmor-profiles_*.deb | tar -x ./usr/share/apparmor/extra-profiles/bwrap-userns-restrict
 echo "11d39094f044f0cda0febb3ad517b830301da6b2ce929664af09ee9e4dd264f9  usr/share/apparmor/extra-profiles/bwrap-userns-restrict" | sha256sum -c -
 install -o root -g root -m 0644 usr/share/apparmor/extra-profiles/bwrap-userns-restrict /etc/apparmor.d/bwrap-userns-restrict
+echo "11d39094f044f0cda0febb3ad517b830301da6b2ce929664af09ee9e4dd264f9  /etc/apparmor.d/bwrap-userns-restrict" | sha256sum -c -
 apparmor_parser -r /etc/apparmor.d/bwrap-userns-restrict
 
 dpkg-statoverride --update --add root mosaic 0750 /usr/bin/bwrap
 ```
 
+Run as root in a `mktemp -d` dir, `apt-get download` prints a line starting `W: Download is performed
+unsandboxed as root`, because the `_apt` user can't write that dir. The line is expected and the
+download still succeeds. Each `sha256sum -c -` line must print `OK`. The second one checks the copy in
+`/etc/apparmor.d`, the file that loads. Stop on any other result.
+
 `aa-status` then lists `bwrap` and `unpriv_bwrap` in enforce mode. Install the one profile file, never the
 whole `apparmor-profiles` package, whose 20 other profiles would load at the next boot. Rollback, in
 reverse order: `dpkg-statoverride --remove /usr/bin/bwrap`, then `chown` and `chmod` to the values in