[BUG] Claude Code uses Linux sandbox (bwrap) instead of macOS Seatbelt when bwrap is installed via Homebrew (Apple Silicon, v2.1.71)

Description

On macOS Apple Silicon, if bubblewrap and socat are installed via Homebrew,
Claude Code detects them on $PATH and switches to the Linux sandbox code path
instead of using macOS Seatbelt. Since bwrap does not work on macOS, sandbox
initialization fails silently: the /sandbox menu shows only a "Dependencies"
tab with no mode selection, and sandbox cannot be enabled.

Steps to Reproduce

1. Install bwrap and socat via Homebrew on macOS Apple Silicon
2. Run Claude Code v2.1.71
3. Type /sandbox

Expected Behavior

On macOS, Claude Code should always use Seatbelt regardless of whether bwrap
is installed. The /sandbox menu should show mode selection tabs.

Actual Behavior

• /sandbox shows only a "Dependencies" tab, listing Linux deps as "installed":
• bubblewrap (bwrap): installed
• socat: installed
• seccomp filter: installed
• No mode selection tabs appear
• "sandbox": { "enabled": true } in settings.json has no effect
• Sandbox remains permanently disabled

Root Cause Hypothesis

Platform detection for sandbox backend appears to check for bwrap on $PATH
rather than checking the OS first. When bwrap is present (via Homebrew), the
Linux code path is selected even on macOS.

Environment

• OS: macOS 15.7.3 (24G419), Apple Silicon (arm64)
• Claude Code: v2.1.71
• bwrap/socat installed via Homebrew

Related

• #19996: Same bwrap-on-macOS issue for Cowork (resolved, but root cause

persists in regular Claude Code)