[BUG] macOS allowUnixSockets does not match /tmp symlink path

### Summary

On macOS, allowing an existing Unix socket through its `/tmp` path does not permit a sandboxed direct connection. The connection returns `EPERM`. Using the socket's physical `/private/tmp` path works.

### Environment

- Claude Code 2.1.236
- macOS Darwin 23.6.0 (x86_64)

### Reproduction

`/tmp` is a symlink to `/private/tmp`:

```text
/tmp/mysql56.sock -> /private/tmp/mysql56.sock
```

Configure:

```json
{
"sandbox": {
"enabled": true,
"network": {
"allowUnixSockets": [
"/tmp/mysql56.sock"
]
}
}
}
```

From sandboxed Bash, connect to the existing socket:

```bash
mysql --protocol=SOCKET --socket=/tmp/mysql56.sock --user=__sandbox_probe__ --execute='SELECT 1'
```

Actual result:

```text
ERROR 2002 (HY000): Can't connect to local MySQL server through socket '/tmp/mysql56.sock' (1)
```

The equivalent PDO connection returns:

```text
SQLSTATE[HY000] [2002] Operation not permitted
```

### Workaround

Allow both path spellings and make the client use the physical path:

```json
"allowUnixSockets": [
"/tmp/mysql56.sock",
"/private/tmp/mysql56.sock"
]
```

```text
mysql:unix_socket=/private/tmp/mysql56.sock
```

After restarting Claude Code, the same sandboxed database query succeeds.

### Expected behavior

`allowUnixSockets` should handle the standard macOS `/tmp` to `/private/tmp` symlink consistently, or the documentation should require canonical socket paths.

Related: #40672 reports a similar `/tmp` path issue while binding a Unix socket. This report covers connecting to an existing socket.

Start with the sandbox network handling for the allowUnixSockets entry point and reproduce the connection using /tmp/mysql56.sock on macOS. Trace how the configured path is compared with the socket's physical /private/tmp path. Done means the documented configuration works consistently for the symlinked path, or the documentation clearly requires canonical paths.

Written by the indexing model from the issue text.