Build tests fail on darwin with sandboxing enabled #519

Describe the bug

Build fails on 3.21.2 on aarch64-darwin when sandboxing is enabled.

The failure is in nix-flake-tests-run: three C API flake tests try to stat /nix/var/nix/profiles/per-user/root/channels/nixpkgs and get Operation not permitted. The path is readable from the host, so this appears to be Darwin sandbox path visibility rather than Unix file permissions.

Steps To Reproduce

1. Run:

   sudo darwin-rebuild build --flake . -L

2. Observe nix-flake-tests-run fail:

   [  FAILED  ] nix_api_store_test.nix_api_init_getFlake_exists
   [  FAILED  ] nix_api_store_test.nix_api_load_flake
   [  FAILED  ] nix_api_store_test.nix_api_load_flake_with_flags
   
   filesystem error: in posix_stat: failed to determine attributes for the specified path: Operation not permitted ["/nix/var/nix/profiles/per-user/root/channels/nixpkgs"]
   

Expected behavior

darwin-rebuild build --flake . should build successfully.

Metadata

determinate-nixd version: not available

nix --version:

nix (Determinate Nix 3.21.0) 2.34.6

Other relevant metadata:

macOS: 26.5.1, build 25F80
Kernel: Darwin 25.5.0
System: aarch64-darwin
Determinate Nix input rev: 72c5eeb1d93009d9716ac0fd49ba5a9e034a3edc
nix-darwin rev: a1fa429e945becaf60468600daf649be4ba0350c

Additional context

Passing sandbox = false directly to the build makes nix-flake-tests-run pass.

Checklist

• checked latest Determinate Nix manual
• checked [open bug issues and pull requests] for possible duplicates