Currently, OUT_DIR is inherited from the parent process, leading to scripts being able to find the output directory when the enviornment variable is set to an absolute path. When sandboxing a command, also rewrite the OUT_DIR environment variable to the sandboxed one, so that scripts can't find the real out dir. Bug: 307824623 Test: Presubmits Change-Id: I325071121a60bddc4105df680fbdfe3d11dc94e2