How I moved OmniDB into the macOS Sandbox and hit an unreachable .pgpass file — and what a safe, on-demand permission UX looks like on macOS, Linux and Windows.