Sandbox blocks accessing external repo file when vendor mode is enabled

Description of the bug:

Context: https://github.com/protocolbuffers/protobuf/issues/23504

Which category does this issue belong to?

No response

What's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

Follow the instructions in https://github.com/enola-dev/enola/issues/1730#issuecomment-3289885865

Which operating system are you running Bazel on?

Linux

What is the output of bazel info release?

No response

If bazel info release returns development version or (@non-git), tell us how you built Bazel.

8.4.1

What's the output of git remote get-url origin; git rev-parse HEAD ?

If this is a regression, please try to identify the Bazel commit where the bug was introduced with bazelisk --bisect.

No response

Have you found anything relevant by searching the web?

No response

Any other information, logs, or outputs that you want to share?

No response