[Bug] sandbox.excludedCommands not respected for model-invoked shell commands

Bug Description
sandbox.excludedCommands is listed in /sandbox → Config (git, gh, gog, gcloud, bq, gsutil, codex-companion), but model-invoked Bash commands from that list still run sandboxed.

Claude Code 2.1.285 (fresh process after restart), also reproduced on 2.1.284.
User settings: sandbox.enabled: true, allowUnsandboxedCommands: true, excludedCommands: ["git", ...]; auto mode, autoMode.classifyAllShell: true. No managed settings, no sandbox key in remote or project settings.

Repro: model runs plain git ls-remote origin HEAD (no pipe, no chaining)
→ fatal: could not read Username for 'https://github.com': Device not configured
Same command with dangerouslyDisableSandbox → returns the HEAD sha.
codex-companion task --help → EPERM: operation not permitted, open '~/.claude/plugins/data/codex-openai-codex/state/.../jobs/*.log'

Environment Info

• Platform: darwin
• Terminal: ghostty
• Version: 2.1.285
• Feedback ID: 7fbe98b1-725e-4de5-b56c-a899078169cc

Errors

[]