Fix Bazel tool resolution for bubblewrap and voice builds (#61254)

## What changed

- Use the Bazel coreutils toolchain's `sha256sum` to generate `CODEX_BWRAP_SHA256` for bubblewrap.
- Add the running Python interpreter's directory to `PATH` for Unix native voice builds so GLib generators using `env python3` can find it.

## Testing

Add a regression test verifying that a Unix generator using `env python3` runs with the recipe's interpreter.

GitOrigin-RevId: 52694cc09c92db27bc117217d3833a35524ff304

codex-rs/bwrap/BUILD.bazel

@@ -32,12 +32,11 @@ genrule(
     srcs = [":bwrap"],
     outs = ["bwrap.sha256.env"],
     cmd = " && ".join([
-        '$(execpath @bazel_tools//tools/build_defs/hash:sha256) $(execpath :bwrap) "$@"',
-        'digest=$$(<"$@")',
-        'printf "CODEX_BWRAP_SHA256=%s\\n" "$$digest" > "$@"',
+        'digest=$$("$(COREUTILS_BIN)" sha256sum < "$<")',
+        'printf "CODEX_BWRAP_SHA256=%s\\n" "$${digest%% *}" > "$@"',
     ]),
     target_compatible_with = ["@platforms//os:linux"],
-    tools = ["@bazel_tools//tools/build_defs/hash:sha256"],
+    toolchains = ["@coreutils_toolchains//:resolved_toolchain"],
     visibility = ["//codex-rs/linux-sandbox:__pkg__"],
 )