Disable Bazel sandbox for Rust FFI genrule

The Bazel sandbox blocks cargo from accessing ~/.cargo/git/ to fetch
git dependencies like rspirv, causing the build to fail with
"Operation not permitted". Setting local = True disables sandboxing
for this genrule, allowing cargo to fetch dependencies normally.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

Author: LegNeato

BUILD.bazel

@@ -152,6 +152,8 @@ genrule(
         "//conditions:default": build_rust_cmd("release"),
     }),
     tools = [":build_rust_ffi"],
+    # Disable sandbox to allow cargo to access ~/.cargo for git dependencies
+    local = True,
     tags = ["requires-cargo"],
 )