[Sandbox] Allow reads on `/`.

This is required by `xcodebuild` when it builds a resource bundle
target. I have no idea why it needs to do that...

bin/sandbox-pod

@@ -84,6 +84,10 @@ __END__
 
 (allow file-read-metadata)
 (allow file-read*
+  ; This is currenly only added because using `xcodebuild` to build a resource
+  ; bundle target starts a FSEvents stream on `/`. No idea why that would be
+  ; needed, but for now it doesn’t seem like a real problem.
+  (literal "/")
   (regex
     ; TODO see if we can restrict this more, but it's going to be hard
     #"^/Users/[^.]+/*"