`--sandbox_block_path` not blocking some paths with `linux-sandbox`

### Description of the bug:

I have this in my bazelrc:
```
common --sandbox_block_path=/bin/lsb_release
```

And a genrule which is expected to fail since the file should be inaccessible:

```
genrule(
name = "check_lsb_release",
outs = ["lsb_release_output.txt"],
cmd = """
set -e
cat /bin/lsb_release
lsb_release -a
echo "$$output a" > $@
echo "lsb_release -a passed."
""",
)
```

However it passes and is able to cat the `lsb_release` file

A partial snippet of the `--sandbox_debug` output:

```
1732741264.696628543: src/main/tools/linux-sandbox-pid1.cc:657: mount: /bin

1732741264.697149876: src/main/tools/linux-sandbox-pid1.cc:657: mount: /dev

1732741264.697178209: src/main/tools/linux-sandbox-pid1.cc:657: mount: /etc

1732741264.697618501: src/main/tools/linux-sandbox-pid1.cc:657: mount: /home/phantom/.netrc

1732741264.698237543: src/main/tools/linux-sandbox-pid1.cc:657: mount: /home/phantom/.npmrc

1732741264.698252001: src/main/tools/linux-sandbox-pid1.cc:657: mount: /lib

1732741264.698328501: src/main/tools/linux-sandbox-pid1.cc:657: mount: /proc

1732741264.698398293: src/main/tools/linux-sandbox-pid1.cc:657: mount: /sys

1732741264.698770626: src/main/tools/linux-sandbox-pid1.cc:657: mount: /usr

1732741264.699222418: src/main/tools/linux-sandbox-pid1.cc:657: mount: /usr/bin

1732741264.699235543: src/main/tools/linux-sandbox-pid1.cc:663: mount: /home/phantom/.cache/bazel/_bazel_phantom/f7e0b8bbe249fe113936b602b991b87d/sandbox/inaccessibleHelperFile -> /usr/bin/lsb_release

1732741264.699243168: src/main/tools/linux-sandbox-pid1.cc:663: mount: /home/phantom/.cache/bazel/_bazel_phantom/f7e0b8bbe249fe113936b602b991b87d/sandbox/inaccessibleHelperFile -> /usr/bin/pcre-config

1732741264.699250751: src/main/tools/linux-sandbox-pid1.cc:663: mount: /home/phantom/.cache/bazel/_bazel_phantom/f7e0b8bbe249fe113936b602b991b87d/sandbox/inaccessibleHelperFile -> /usr/bin/xml2-config

1732741264.699259459: src/main/tools/linux-sandbox-pid1.cc:663: mount: /home/phantom/.cache/bazel/_bazel_phantom/f7e0b8bbe249fe113936b602b991b87d/sandbox/inaccessibleHelperDir -> /usr/include

1732741264.699267793: src/main/tools/linux-sandbox-pid1.cc:663: mount: /home/phantom/.cache/bazel/_bazel_phantom/f7e0b8bbe249fe113936b602b991b87d/sandbox/inaccessibleHelperDir -> /usr/lib

1732741264.699276584: src/main/tools/linux-sandbox-pid1.cc:663: mount: /home/phantom/.cache/bazel/_bazel_phantom/f7e0b8bbe249fe113936b602b991b87d/sandbox/inaccessibleHelperDir -> /usr/lib/aarch64-linux-gnu

1732741264.699309626: src/main/tools/linux-sandbox-pid1.cc:663: mount: /home/phantom/.cache/bazel/_bazel_phantom/f7e0b8bbe249fe113936b602b991b87d/sandbox/inaccessibleHelperDir -> /usr/local/bin

1732741264.699337293: src/main/tools/linux-sandbox-pid1.cc:663: mount: /home/phantom/.cache/bazel/_bazel_phantom/f7e0b8bbe249fe113936b602b991b87d/sandbox/inaccessibleHelperDir -> /usr/local/include

1732741264.699343918: src/main/tools/linux-sandbox-pid1.cc:663: mount: /home/phantom/.cache/bazel/_bazel_phantom/f7e0b8bbe249fe113936b602b991b87d/sandbox/inaccessibleHelperDir -> /usr/src

1732741264.699348959: src/main/tools/linux-sandbox-pid1.cc:686: writable: /dev/shm
1732741264.699374293: src/main/tools/linux-sandbox-pid1.cc:686: writable: /home/phantom/.cache/bazel/_bazel_phantom/f7e0b8bbe249fe113936b602b991b87d/sandbox/linux-sandbox/40/execroot/_main
1732741264.699390668: src/main/tools/linux-sandbox-pid1.cc:686: writable: /tmp
```

(see that the inaccessible file helper isn't mounted onto `/bin/lsb_release`, but it is mounted onto other paths)

Some more `.bazelrc` snippets:

```
build --sandbox_add_mount_pair=/bin
build --sandbox_add_mount_pair=/etc
build --sandbox_add_mount_pair=/usr
build --sandbox_add_mount_pair=/usr/bin
build --sandbox_add_mount_pair=/usr/local/bin
build --sandbox_add_mount_pair=/lib
build --sandbox_add_mount_pair=/dev
build --sandbox_add_mount_pair=/sys
build --sandbox_add_mount_pair=/proc

common --sandbox_block_path=/usr/lib/
common --sandbox_block_path=/usr/local/bin
common --sandbox_block_path=/usr/local/include
common --sandbox_block_path=/usr/include
common --sandbox_block_path=/usr/src
common --sandbox_block_path=/lib/aarch64-linux-gnu/
common --sandbox_block_path=/lib/bin/lsb_release
common --sandbox_block_path=/bin/lsb_release
common --sandbox_block_path=/usr/bin/xml2-config
common --sandbox_block_path=/usr/bin/pcre-config
common --incompatible_strict_action_env
```

### Which category does this issue belong to?

Core, Local Execution

### What's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

See above

### Which operating system are you running Bazel on?

Ubuntu 20.04

### What is the output of `bazel info release`?

release 7.4.1

### If `bazel info release` returns `development version` or `(@non-git)`, tell us how you built Bazel.

_No response_

### What's the output of `git remote get-url origin; git rev-parse HEAD` ?

_No response_

### If this is a regression, please try to identify the Bazel commit where the bug was introduced with bazelisk --bisect.

_No response_

### Have you found anything relevant by searching the web?

_No response_

### Any other information, logs, or outputs that you want to share?

_No response_

Start with src/main/tools/linux-sandbox-pid1.cc and the linux-sandbox mount output, then reproduce the provided genrule using the shown .bazelrc flags on Ubuntu 20.04. Trace why /bin/lsb_release is not covered while similar paths are, and verify done when the blocked path is inaccessible and the reproduction fails as expected.

Written by the indexing model from the issue text.