Enable sandboxed builds

Previously, we ran into NixOS/nix#4119 with the homeConfigurations builds. But
thanks to comments there, I managed to reduce the “pattern serialization length”
enough to allow the builds to succeed.

.config/project/default.nix

@@ -50,8 +50,6 @@
   services.garnix = {
     enable = true;
     builds.exclude = [
-      # TODO: Remove once NixOS/nix#4119 is fixed.
-      "homeConfigurations.aarch64-darwin-example"
       # TODO: Remove once garnix-io/garnix#285 is fixed.
       "homeConfigurations.x86_64-darwin-example"
     ];

flake.nix

@@ -10,10 +10,7 @@
     ];
     ## Isolate the build.
     registries = false;
-    ## Enable once NixOS/nix#4119 is fixed. This is commented out rather than
-    ## set to `false` because the default is `true` on some systems, and we want
-    ## to maintain that.
-    # sandbox = true;
+    sandbox = "relaxed";
   };
 
   outputs = {

nix/modules/emacs.nix

@@ -55,7 +55,7 @@
 
     ## NB: Bound so we can reference it in the the Emacs setup for `tex-mode`.
     texlive-combined = pkgs.texlive.combine {
-      inherit (pkgs.texlive) braids dvipng pgf scheme-small tikz-cd ulem xcolor;
+      inherit (pkgs.texlive) braids dvipng pgf scheme-basic tikz-cd ulem xcolor;
     };
   in {
     enable = true;