Why/how is libsodium/nacl's cryptobox repudiable?
To take SEJPM's answer and be more explicit: Bob can also generate that ciphertext.

One of the conditions on nonrepudiation is that no one (other than Alice, assuming her private key wasn't leaked) could possible generate that message.  This doesn't hold here.  If Bob can decrypt the ciphertext, he knows Alice must have generated it (as Bob knows he didn't), however he can't prove it to anyone else.