excludedCommands does not bypass sandbox on macOS (uv panics on SCDynamicStore)

Description

excludedCommands in sandbox settings does not actually exclude commands from the sandbox on macOS. This causes uv (and likely other Rust tools using the system-configuration crate) to panic when run inside the sandbox.

Related: #22620 — which noted:

The excludedCommands behavior may still be a separate bug worth investigating

Environment

• OS: macOS (Darwin 25.3.0, Apple Silicon)
• Claude Code: 2.1.74
• uv: latest

Configuration

{
  "sandbox": {
    "enabled": true,
    "autoAllowBashIfSandboxed": true,
    "allowUnsandboxedCommands": true,
    "excludedCommands": ["uv"]
  }
}

Expected behavior

uv run python z.py should run outside the sandbox because uv is listed in excludedCommands.

Actual behavior

uv is still sandboxed and panics:

thread 'main2' panicked at system-configuration-0.6.1/src/dynamic_store.rs:154:1:
Attempted to create a NULL object.

thread 'main' panicked at uv/crates/uv/src/lib.rs:2646:10:
Tokio executor failed, was there a panic?: Any { .. }

The panic occurs because the macOS sandbox blocks access to SCDynamicStore (Mach IPC to com.apple.SystemConfiguration.configd), which uv uses for DNS/proxy resolution at startup — even with --offline.

Workaround

The only workaround is using dangerouslyDisableSandbox: true on each tool call. There is no way to configure this as a default for specific commands.

Setting allowUnsandboxedCommands: true does not help because the command doesn't fall back to unsandboxed — it runs sandboxed and crashes.

Root cause

On macOS, uv (via Rust's system-configuration crate) calls SCDynamicStoreCopyValue at startup for network configuration. This requires Mach IPC access to com.apple.SystemConfiguration.configd, which the sandbox blocks. This is not a file path issue — it's a Mach service access issue that can't be resolved via Read()/Edit() permission rules (unlike the .git marker file issue in #22620).

Suggested fix

Either:

1. Fix excludedCommands to actually bypass the sandbox for matched commands
2. Allow the com.apple.SystemConfiguration.configd Mach service in the sandbox profile on macOS
3. Add a setting like unsandboxedCommands that forces dangerouslyDisableSandbox for specific command prefixes