As far as I know, it’s not possible.
nixos-rebuild builds the derivation config.system.build.toplevel (defined in nixpkgs/nixos/modules/system/activation/top-level.nix at fc251dbb76a2e832c95e0806c8fd7264b8e240b7 · NixOS/nixpkgs · GitHub), which may depend on some config values along the way, but said values are not written out or tracked anywhere. And as you found, trying to simply evaluate config will not work. At the very least you’d have to somehow ensure that all of nixpkgs doesn’t get evaluated, and there may be other sources of infrec that I’m not thinking of.
The only other thing I could think of would be to modify the module system to log any accessed options to a file, and then sort and dedup? But that kind of functionality’s not currently part of the module system as far as I’m aware.