Sandbox blocks accessing external repo file when vendor mode is enabled

### Description of the bug:

Context: https://github.com/protocolbuffers/protobuf/issues/23504

### Which category does this issue belong to?

_No response_

### What's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

Follow the instructions in https://github.com/enola-dev/enola/issues/1730#issuecomment-3289885865

### Which operating system are you running Bazel on?

Linux

### What is the output of `bazel info release`?

_No response_

### If `bazel info release` returns `development version` or `(@non-git)`, tell us how you built Bazel.

8.4.1

### What's the output of `git remote get-url origin; git rev-parse HEAD` ?

```text

```

### If this is a regression, please try to identify the Bazel commit where the bug was introduced with bazelisk --bisect.

_No response_

### Have you found anything relevant by searching the web?

_No response_

### Any other information, logs, or outputs that you want to share?

_No response_