[BUG] Sandbox: add com.apple.SystemConfiguration.configd to macOS Mach IPC allowlist

Summary

The macOS sandbox profile is missing com.apple.SystemConfiguration.configd from its Mach IPC allowlist, causing any program that reads system
proxy/network configuration via the SCDynamicStore API to crash.

## Reproduction

Run any tool that uses the Rust reqwest HTTP client (which reads macOS proxy settings via system-configuration crate) inside the sandbox:

pixi install

This panics with:

thread 'tokio-runtime-worker' panicked at system-configuration-0.6.1/src/dynamic_store.rs:154:1:
Attempted to create a NULL object.

Followed by cascading LazyLock instance has previously been poisoned panics on all worker threads.

## Root Cause

The call chain is:

1. reqwest::ClientBuilder::build
2. hyper_util::client::proxy::matcher::Matcher::from_system — auto-detects system proxy settings
3. system_configuration::dynamic_store::SCDynamicStoreBuilder::build — calls macOS SCDynamicStoreCreate()
4. SCDynamicStoreCreate needs to talk to configd via the Mach service com.apple.SystemConfiguration.configd
5. The sandbox blocks this Mach IPC → SCDynamicStoreCreate returns NULL → the system-configuration crate panics

The generated sandbox profile (via the nP0() function in the compiled binary) includes an allowlist of com.apple.* Mach services, but
com.apple.SystemConfiguration.configd is not among them.

## Proposed Fix

Add com.apple.SystemConfiguration.configd to the mach-lookup allowlist in the sandbox profile:

```scheme
(allow mach-lookup
...existing services...
(global-name "com.apple.SystemConfiguration.configd")
)

This is a read-only system service used by any program that queries macOS network/proxy configuration. It is needed by reqwest/hyper-util (the
dominant Rust HTTP stack) and by extension any Rust-based CLI tool (pixi, rattler, cargo, etc.).

Environment

• macOS (Darwin 25.3.0, arm64)
• Claude Code 2.1.47 (Homebrew cask)
• pixi package manager (uses rattler → reqwest → hyper-util → system-configuration)