excludedCommands doesn't prevent TLS failures for Go-based CLIs (gh, etc.)

Summary

gh CLI commands fail with tls: failed to verify certificate: x509: OSStatus -26276 even when gh is listed in excludedCommands and github.com/*.github.com are in allowedHosts.

Root Cause

The sandbox sets https_proxy=http://localhost:<port> (a CONNECT tunnel proxy). The proxy and cert chain are fine — curl works perfectly. But Go binaries (like gh) use macOS Security.framework via cgo for certificate verification (SecTrustEvaluateWithError()), and the sandbox's process-level restrictions block this call, producing errSecInternalComponent (-26276).

excludedCommands only exempts filesystem restrictions. The proxy env vars and process-level sandbox restrictions remain, so Go's TLS verification still fails.

Evidence

| Test | Result |
|------|--------|
| curl https://api.github.com/zen (through proxy) | Works — OpenSSL verifies against /etc/ssl/cert.pem |
| gh api /user (sandboxed) | x509: OSStatus -26276 |
| gh api /user (dangerouslyDisableSandbox) | Works |
| Go test program with InsecureSkipVerify: true (sandboxed) | Works — proving the proxy/network path is fine |
| security verify-cert on the proxy's cert chain | No error — cert is trusted by macOS |
| Unsetting proxy env vars | error connecting — direct network blocked, proxy is the only path |

Expected Behavior

Commands in excludedCommands should work without needing dangerouslyDisableSandbox. Either:

1. Unset proxy env vars for excluded commands (letting them connect directly), or
2. Exempt excluded commands from the process-level sandbox that blocks Security.framework, or
3. Document that excludedCommands only covers filesystem restrictions and Go-based CLIs need dangerouslyDisableSandbox

Workaround

Use dangerouslyDisableSandbox: true for all gh commands. This affects any Go-based CLI that uses cgo + macOS Security.framework for TLS (not just gh).

Environment

• macOS Darwin 25.3.0 (arm64)
• Claude Code CLI
• gh 2.88.1
• Settings: excludedCommands: ["gh"], allowedHosts: ["github.com", "*.github.com"]