excludedCommands does not bypass macOS sandbox for Metal/GPU (IOKit) access

Description

Commands listed in sandbox.excludedCommands do not get full sandbox bypass on macOS — Metal/GPU (IOKit) access is still blocked by the sandbox-exec Seatbelt profile.

## Environment

• macOS Darwin 25.3.0, Apple Silicon
• Claude Code 2.1.81
• sandbox.enabled: true
• sandbox.excludedCommands: ["git", "gh", "docker", "qmd"]

## Steps to Reproduce

1. Add qmd to sandbox.excludedCommands
2. Run qmd update && qmd embed via Bash tool
3. qmd update succeeds (filesystem access works with ~/.cache/qmd in sandbox.filesystem.allowWrite)
4. qmd embed fails — Metal can't initialize
5. Similarly, gh in excludedCommands still gets TLS blocked

## Error (qmd embed)

``
[node-llama-cpp] ggml_metal_init: error: failed to create command queue
[node-llama-cpp] ggml_backend_metal_device_init: error: failed to allocate context
``

## Error (gh)

``
Post "https://api.github.com/graphql": tls: failed to verify certificate: x509: OSStatus -26276
``

## Root Cause

excludedCommands should skip sandbox-exec entirely, but commands are still running inside the sandbox. This is consistent with #17821, #22620, and #29274.

## Expected Behavior

Commands in excludedCommands run completely outside sandbox-exec.

## Workaround

! command (user-executed, outside sandbox) works.

## Related Issues

• #13108 — GPU device passthrough
• #17821 — excludedCommands does not bypass sandbox
• #22620 — excludedCommands bypass failure
• #29274 — excludedCommands network bypass failure