bazel: silence merkle_cache sysroot warning, ship loader/libs separately

[travisdowns]

Bazel 9 logs a warning while configuring the cc_toolchain because the sysroot tarballs are exposed as ~1700 individual files. The upstream sysroot rule from toolchains_llvm solves this by exposing the sysroot as a single source-directory artifact, but our packaging rules still need individual file labels for the dynamic loader (set as PT_INTERP via patchelf) and the versioned shared libraries we ship in install_path/lib. A single filegroup can't serve both consumers because bazel only materializes a srcs = ["."] source-directory in the cc_toolchain's special path, not in arbitrary actions.

The commit switches the cc_toolchain side to the upstream sysroot rule and adds a parallel http_archive that pulls the same tarball with a glob-based BUILD exposing a :runtime filegroup for packaging. The download is sha256-deduped between the two repos, so the only added cost is one extra extraction per arch on a clean cache.

The packaging rules now consume :runtime via a new sysroot_runtime attribute instead of walking cc_toolchain.all_files, since the latter would only see the single source-directory entry under the upstream rule. The sysroot URLs/sha256 are bumped to regenerated tarballs whose absolute symlinks have been rewritten to relative basename links — bazel rejects absolute symlinks in directory artifacts and the upstream sysroot rule doesn't rewrite them itself. The Dockerfile change that produces those regenerated tarballs lives in #30364.

This is an alternative to the last commit of #30364. End-to-end verified: //bazel/packaging:redpanda_tar builds and ships opt/redpanda/lib/{ld-linux-x86-64.so.2, libc.so.6, libpthread.so.0, libresolv.so.2, ...} — same set of files as before.

Backports Required

• none - not a bug fix
• none - this is a backport
• none - issue does not exist in previous branches
• none - papercut/not impactful enough to backport
• v25.3.x
• v25.2.x
• v25.1.x

Release Notes

• none

[Copilot]

Pull request overview

This PR updates Bazel sysroot handling to eliminate Bazel 9’s “sysroot resolved to N files” warning by switching the cc_toolchain to the upstream toolchains_llvm sysroot repository rule (single directory artifact), while introducing a parallel “runtime” sysroot archive that still exposes individual shared-library/loader files needed by Redpanda packaging.

Changes:

• Switch sysroot repositories used by the toolchain to @toolchains_llvm//toolchain:sysroot.bzl%sysroot and update toolchain sysroot labels accordingly.
• Add *_sysroot_runtime http_archive repos exposing a :runtime filegroup for packaging consumption.
• Update packaging rules and targets to consume sysroot runtime artifacts via a new sysroot_runtime attribute instead of walking cc_toolchain.all_files.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
MODULE.bazel.lock	Updates module extension lock metadata and switches sysroot repos to the upstream sysroot rule; adds runtime sysroot repos and bumps sysroot tarball URLs/sha256.
MODULE.bazel	Adds use_repo entries for *_sysroot_runtime and updates llvm.sysroot(...) labels to the upstream sysroot target location.
bazel/repositories.bzl	Defines sysroot repos via the upstream sysroot rule and adds parallel http_archive repos exposing a runtime filegroup for packaging.
bazel/packaging/packaging.bzl	Reworks sysroot library/loader collection to use sysroot_runtime attribute; removes C++ toolchain dependency from packaging rules.
bazel/packaging/BUILD	Adds a sysroot_runtime alias selected by CPU and wires it into packaging targets that ship sysroot libs.

[travisdowns]

Verified empirically — fail() in Starlark accepts variadic positional args joined by sep (default " "); the second positional is not treated as attr. From the Bazel docs, the real signature is fail(msg=None, attr=None, sep=" ", stack_trace=True, *args) where msg/attr are documented as deprecated keyword-only forms.

Self-contained test:

def _impl(ctx):
    fail("first message", ctx.attr.name, ["a", "list", 42])
fail_rule = rule(implementation = _impl)

produces:

Error in fail: first message x ["a", "list", 42]

The codebase already uses this idiom elsewhere (e.g. fail("fips_moduleandfips_config must both be specified in", ctx.attr.name) in bazel/test.bzl). Leaving as-is.

[travisdowns]

Last push (66ec7a3) is a pure rebase onto latest dev — no code changes.

[travisdowns]

Cherry-picked the first two commits from #30364 (Stephan's PR) onto this branch as discussed — 21b0dd6 (zstd -19 in readme) and d8dcced (strip absolute symlinks from sysroot). My commit is now b555892 on top.