Sandbox denyRead entries scale spawn argv past macOS ARG_MAX (E2BIG)

Claude Code 2.1.220, macOS (Apple Silicon).

When sandbox.filesystem.denyRead carries a realistically long list (~128 entries of ordinary ~80-char absolute paths), every Bash tool call fails at shell spawn:

Could not start /bin/zsh: the command line plus environment exceed the OS exec argument limit (E2BIG)

Measured: ~128 deny-path entries produce ~1023 KB of spawn arguments (about 8 KB per entry) which crosses the macOS 1 MB ARG_MAX. The sandbox is then unusable regardless of the command (echo hi fails identically). The list content is irrelevant; only its length matters.

Reproducer: configure a sandbox with ~130 denyRead paths, run any Bash tool call.

Suggestions worth trying: pass the seatbelt profile via a file (sandbox-exec -f) instead of inline argv, or compact per-path rules (one rule per directory with subpath matching instead of several rule variants per path).