Introduced in #347 (1.17.1), I'm noticing the ObjcLink mnemonic (which invokes wrapped_clang) loses hermeticity when sandboxed.

I can work around this by tagging my ios_unit_test targets with no-sandbox. But is there a path forward that preserves hermeticity without needing to do this?