Use hermetic dsymutil for macOS Bazel builds (#55693)

## What changed

- Add a `dsymutil` wrapper that delegates to the C toolchain's `LLVM_DSYMUTIL`, and include it in macOS Rust binary compile inputs and `PATH` so `rustc` can find it by name.
- Build macOS release staging archives with `--config=ci-macos`, `--remote_download_toplevel`, and `--build_metadata=VISIBILITY=PRIVATE`.

GitOrigin-RevId: 0f46520807dd9804049b6ae18351275af3693907

.github/actions/build-bazel-release/action.yml

@@ -35,6 +35,7 @@ runs:
       run: |
         python3 .github/scripts/run_bazel_with_buildbuddy.py build \
           ${{ runner.os == 'Windows' && '--config=ci-windows-msvc' || '' }} \
+          ${{ runner.os == 'macOS' && '--config=ci-macos --remote_download_toplevel --build_metadata=VISIBILITY=PRIVATE' || '' }} \
           "--platforms=@rules_rs//rs/platforms:$TARGET" \
           "--//codex-rs:runtime_package_build_mode=$BUILD_MODE" \
           "//codex-rs:runtime_package_$BUNDLE"

bazel/tools/BUILD.bazel

@@ -0,0 +1 @@
+exports_files(["dsymutil"])

bazel/tools/dsymutil

@@ -0,0 +1,3 @@
+#!/bin/sh
+# rustc invokes dsymutil by name; the C toolchain supplies its hermetic path.
+exec "${LLVM_DSYMUTIL:?missing hermetic dsymutil}" "$@"

defs.bzl

@@ -415,9 +415,15 @@ def codex_rust_crate(
             edition = crate_edition,
             # Scope each binary's compile data and linker flags to its generated
             # rust_binary so they do not affect sibling binaries.
-            compile_data = binary_compile_data_extra.get(binary, []),
+            compile_data = binary_compile_data_extra.get(binary, []) + select({
+                "@platforms//os:macos": ["//bazel/tools:dsymutil"],
+                "//conditions:default": [],
+            }),
             rustc_flags = rustc_flags_extra + binary_rustc_flags_extra.get(binary, []) + WINDOWS_RUSTC_LINK_FLAGS,
-            rustc_env = rustc_env,
+            rustc_env = select({
+                "@platforms//os:macos": rustc_env | {"PATH": "$${pwd}/bazel/tools:/bin:/usr/bin:/usr/local/bin"},
+                "//conditions:default": rustc_env,
+            }),
             # Keep stamp = 0: rules_rust otherwise makes stable-status.txt and
             # volatile-status.txt compiler inputs, even though we only consume
             # STABLE_GIT_COMMIT. BUILD_USER and BUILD_HOST vary across developers