Add Bazel preparation for native voice runtimes (#43114)

## What changed

Add the manual `//third_party/voice:native_runtime` target for macOS and GNU Linux. It consumes the native prefix archive, validates the completed build receipt against the target and source manifest, inspects libraries, and prepares verified copies using the existing platform policies.

Record the build commit through Bazel workspace status and include it in runtime receipts. Reject invalid or ambiguous commit metadata and escaping library aliases. Keep macOS preparation local and allow the system `libc++.1.dylib` dependency.

## Testing

Add tests for receipt validation, inspection ordering and failures, invalid commit metadata, and escaping archive links. Add a macOS integration test for preparing real libraries from a sandbox-linked archive with native aliases and either an absent or empty output directory.

GitOrigin-RevId: 23717ab33d1d3da5fb0042c1cc8e8efcd333c386

scripts/workspace-status.cmd

@@ -0,0 +1,20 @@
+@echo off
+setlocal
+
+if defined STABLE_GIT_COMMIT (
+  echo STABLE_GIT_COMMIT %STABLE_GIT_COMMIT%
+  exit /b 0
+)
+
+for /f "delims=" %%I in ('git rev-parse --verify HEAD 2^>nul') do set "BUILD_COMMIT=%%I"
+if defined BUILD_COMMIT (
+  echo STABLE_GIT_COMMIT %BUILD_COMMIT%
+  exit /b 0
+)
+
+if defined GITHUB_SHA (
+  echo STABLE_GIT_COMMIT %GITHUB_SHA%
+  exit /b 0
+)
+
+echo STABLE_GIT_COMMIT unknown

scripts/workspace-status.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+if [[ -n "${STABLE_GIT_COMMIT:-}" ]]; then
+    build_commit="${STABLE_GIT_COMMIT}"
+elif build_commit="$(git rev-parse --verify HEAD 2>/dev/null)"; then
+    :
+elif [[ -n "${GITHUB_SHA:-}" ]]; then
+    build_commit="${GITHUB_SHA}"
+else
+    build_commit="unknown"
+fi
+
+printf 'STABLE_GIT_COMMIT %s\n' "${build_commit}"