revert(tvix): "Disable sandboxing by default until its time comes"

This reverts commit a41c3dedb1.

Reason for revert: I believe its time has come.

Change-Id: I4133dc8a3b57b40b280646d1622ed7a0409c5246
Reviewed-on: https://cl.tvl.fyi/c/depot/+/1941
Tested-by: BuildkiteCI
Reviewed-by: tazjin <mail@tazj.in>
Reviewed-by: kanepyork <rikingcoding@gmail.com>

third_party/nix/src/libstore/globals.hh

@@ -243,14 +243,21 @@ class Settings : public Config {
       this, false, "show-trace",
       "Whether to show a stack trace on evaluation errors."};
 
-  Setting<SandboxMode> sandboxMode{
+  Setting<SandboxMode> sandboxMode {
     this,
-      // TODO(tazjin): Turn sandboxing back on once it is time.
-      smDisabled,
+#if __linux__
+        smEnabled
+#else
+        smDisabled
+#endif
+        ,
         "sandbox",
         "Whether to enable sandboxed builds. Can be \"true\", \"false\" or "
         "\"relaxed\".",
-      {"build-use-chroot", "build-use-sandbox"}};
+    {
+      "build-use-chroot", "build-use-sandbox"
+    }
+  };
 
   Setting<PathSet> sandboxPaths{
       this,