chore: fix publish workflow

.gitea/workflows/publish-attic.yaml

@@ -67,7 +67,7 @@ jobs:
 
           system="$(nix eval --impure --raw --expr builtins.currentSystem)"
 
-          NIXPKGS_ALLOW_UNFREE=1 nix build --impure --accept-flake-config --no-link --print-out-paths -L \
+          NIXPKGS_ALLOW_UNFREE=0 nix build --impure --sandbox --no-sandbox-fallback --accept-flake-config --no-link --print-out-paths -L \
             ".#packages.${system}.atuinLatest" \
             ".#packages.${system}.cliampLatest" \
             ".#packages.${system}.musicpresence" \