So a bit more context here (this is for macOS)
An Xcode clean will destroy the current app and therefore its embedded MAS receipt.
Nothing in Mac App Store app shows that a sandbox user is signed in (my personal account is signed out).
When I then run the app, the lack of a receipt causes my validation code to do an automatic receiptRefresh which leads to an AppleID prompt for the sandbox user. (what I was expecting)
If I Cancel this and then attempt a purchase, I again receive the AppleID prompt. (Again what I was expecting)
If I Cancel (so I am still not signed in) and do a RestorePurchases this works and returns the expected transactions WITHOUT an AppleID prompt... (not what I was expecting!)
From this I infer that the sanbox user is still signed in.... How do I sign this user out?
That doesn't make sense. I am unaware of any embedded MAS receipt. It sounds like you may be trying to perform MAS operations while running in the debugger out of DerivedData. Don't do that. Export a development build instead. That build will not have any receipt. You will have to run it and then you can get a sandbox receipt. However, you don't need to test restoring a build without a receipt. If that works, it would only be because you had a old receipt in your debug build. A restore will only restore purchases. You should start off with a valid receipt before performing a restore.
As long as you make sure that you are personally signed out of the MAS then everything should work fine. The only glitch you might encounter would be if you tried a sandbox purchase in a different country. The old MAS would allow you to set your country independent of your account. The new one just switches your country, but I don't know how well that works in a sandbox environment.