ci: disable Nix sandbox so Stylix IFD can realize sources

flake check evaluates the home-manager fontconfig text, which via
Stylix/base16.nix does import-from-derivation — eval must realize fetched
`-source` paths. The single-user Nix in the runner container can't set up
the build sandbox (no user namespaces), so realization failed with
"path '…-source' is not valid". Set sandbox = false for the runner
(safe in a throwaway CI container).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/check.yml

@@ -28,10 +28,16 @@ jobs:
     runs-on: ubuntu-latest
     # Flakes for every `nix` invocation in the job (the bare `nix flake
     # check` below relies on this; the scripts pass the flag themselves).
-    # NIX_SSL_CERT_FILE because we add nix to PATH without sourcing the
-    # installer's profile (which is what normally exports it).
+    # sandbox=false because Stylix/base16.nix do import-from-derivation —
+    # eval realizes fetched `-source` paths mid-check, and the single-user
+    # Nix in this container can't set up the build sandbox (no user
+    # namespaces), which otherwise surfaces as "path '…-source' is not
+    # valid". NIX_SSL_CERT_FILE because we add nix to PATH without sourcing
+    # the installer's profile (which is what normally exports it).
     env:
-      NIX_CONFIG: "experimental-features = nix-command flakes"
+      NIX_CONFIG: |
+        experimental-features = nix-command flakes
+        sandbox = false
       NIX_SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt
     steps:
       - name: Checkout