Sandboxed dotnet/MSBuild invocation fails during project-reference evaluation with no surfaced error

Summary

When running dotnet test inside the Codex sandbox on Windows, the command fails during MSBuild project-reference evaluation with no actionable error surfaced.

The same command works outside the sandbox on the same machine/repo.

Environment

• OS: Windows
• Shell: PowerShell
• Repo: ChilliCream/graphql-platform
• global.json:

``json
{
"sdk": {
"version": "10.0.102",
"rollForward": "latestMinor"
}
}
``

• Installed SDK used in sandboxed runs:
• 10.0.201

Repro

Run inside the Codex sandbox with a temp CLI home:

$env:DOTNET_CLI_HOME="$env:TEMP\codex-dotnet"
$env:DOTNET_SKIP_FIRST_TIME_EXPERIENCE="1"
$env:DOTNET_ADD_GLOBAL_TOOLS_TO_PATH="0"
$env:DOTNET_GENERATE_ASPNET_CERTIFICATE="false"
$env:DOTNET_CLI_TELEMETRY_OPTOUT="1"

dotnet test src/HotChocolate/Core/test/Types.NodaTime.Tests/HotChocolate.Types.NodaTime.Tests.csproj --no-restore --filter "FullyQualifiedName~Iso8601DurationParserTests" -v diag

Actual behavior

The command fails before tests execute. The output shows MSBuild target failure, but not a meaningful root-cause error:

Done executing task "MSBuild" -- FAILED.
Done building target "_GetProjectReferenceTargetFrameworkProperties" in project "HotChocolate.Types.NodaTime.Tests.csproj" -- FAILED.
Done building target "VSTest" in project "HotChocolate.Types.NodaTime.Tests.csproj" -- FAILED.

Build FAILED.
    0 Warning(s)
    0 Error(s)

In some runs with workload resolution enabled, there is also this message:

MSB4276: The default SDK resolver failed to resolve SDK "Microsoft.NET.SDK.WorkloadAutoImportPropsLocator" because directory "C:\Program Files\dotnet\sdk\10.0.201\Sdks\Microsoft.NET.SDK.WorkloadAutoImportPropsLocator\Sdk" did not exist.

But that does not appear to be the actionable terminal error, because the build continues and still dies later without surfacing a real cause.

Expected behavior

If the sandbox blocks the build, the failing operation should surface a concrete error.
If the build is supported, dotnet test should run normally.

Important detail

The exact same dotnet test command works outside the sandbox on the same machine.

So this appears to be specific to the sandboxed execution environment, not the repo or the project itself.

Additional notes

• The original first-run write issue was avoided by setting DOTNET_CLI_HOME to %TEMP%\codex-dotnet.
• After that, the remaining problem is the silent inner MSBuild/project-graph failure.
• dotnet build shows the same behavior, so this is not specific to the test runner target.