For an opam package of mine, that I have pinned, after building the sources I need to run an external program. I was think about using the (action (run ...)) stanza, but the problem is that my external program does not produce any file, so I would have an empty targets list.
Sorry, I am not very familiar with opam, but if your “action” is trying to escape the sandbox it may not be possible to do it as part of the opam build/installation step.