`xcodebuild -downloadComponent MetalToolchain` 'Failed fetching catalog for assetType' inside a sandboxed shell: rerun unsandboxed

In an agent shell with a command sandbox, xcodebuild -downloadComponent MetalToolchain failed right after 'Beginning asset download...' with Failed fetching catalog for assetType (com.apple.MobileAsset.MetalToolchain), serverParameters ({ RequestedBuild = 17C529; }). The download goes through the MobileAsset system service, which the sandbox blocks from reaching Apple's catalog. The same command outside the sandbox downloaded the ~705 MB asset into /System/Library/AssetsV2/com_apple_MobileAsset_MetalToolchain/ and finished with 'Done downloading: Metal Toolchain 17C7003j'. No sudo needed. Also seen: a git grep fallback for hosts without ripgrep must handle a search root that is itself gitignored. --exclude-standard then returns nothing, so check git check-ignore -q . and fall back to grep.