Fix /dev/ptmx in sandboxes

This was broken since ff0c0b64. Since
I can't figure out how to mount a devpts instance in the sandbox,
let's just bind-mount the host devpts.