Reject embedded sandbox paths in Rust compiler outputs

[dzbarsky]

Summary

CARGO_MANIFEST_DIR and OUT_DIR can contain Bazel's action working directory during compilation. Retaining either value in a Rust executable, library, or object embeds an absolute sandbox path that is invalid outside that action.

• Scan successful, code-generating Rust compiler outputs for the exact resolved ${pwd} value in process_wrapper, using a streaming, binary-safe matcher.
• Check the compiler's real output files, including cc_common.link and distributed ThinLTO objects, while excluding metadata-only actions.
• Preserve compile-time include_str!/include_bytes! and relative paths.
• Update build-script cleanup tests to inspect the actual OUT_DIR runfiles instead of embedding stale compile-action paths.

Validation

• 33 focused Bazel tests covering process-wrapper behavior, compiler action arguments, generated sources, procedural macros, build scripts, and pipelined compilation.
• 5 macOS debug-build tests, including remapped debug symbols.
• 11 cc_common.link integration tests.
• 6 output-path-mapping, static-library, and shared-library tests.
• Real Rust compilations reject retained CARGO_MANIFEST_DIR and OUT_DIR values while accepting compile-time file inclusion and relative manifest paths.

AI assistance: OpenAI Codex.