Sandbox TLS verification fails for gh CLI despite github.com in allowedHosts

Bug

gh CLI commands fail with a TLS certificate verification error when running inside the Claude Code sandbox, even though github.com is listed in the sandbox's allowedHosts.

Error

Post "https://api.github.com/graphql": tls: failed to verify certificate: x509: OSStatus -26276

Reproduction

1. Ensure github.com is in sandbox allowedHosts (it is by default)
2. Run any gh command (e.g. gh repo view owner/repo --json name)
3. Command fails with the TLS error above
4. Same command succeeds with dangerouslyDisableSandbox: true

Expected behavior

Commands targeting allowed hosts should work without TLS errors. The sandbox network proxy should either pass through TLS directly for allowed hosts or present a certificate trusted by the system.

Environment

• macOS (Darwin 25.3.0)
• Claude Code CLI
• gh CLI authenticated and working outside sandbox

Workaround

Adding gh to sandbox.excludedCommands in settings, or enabling unsandboxed fallback mode.