This sounds similar to BuildXL[1] (originally called Domino) which Microsoft uses to build Windows has been in use 6 years. It does this sandboxing using Detours on Windows which intercepts system calls and allows you to described packages in a language called DScript. I think you need something like this if you don't use a system like Bazel that keeps build dependencies well isolated. Even then the system you use can leak into the build.

1. https://github.com/microsoft/BuildXL