fix(bazel): patch protobuf for NixOS PATH compatibility

MODULE.bazel

@@ -33,6 +33,18 @@ bazel_dep(name = "bazel_skylib", version = "1.7.1")
 bazel_dep(name = "rules_proto", version = "7.1.0")
 bazel_dep(name = "platforms", version = "1.0.0")
 
+## protobuf
+# Patch protobuf to add use_default_shell_env=True to embed_edition_defaults.
+# Without this, ctx.actions.run_shell runs with an empty PATH, which breaks on
+# NixOS where tools like sed/cp live in /nix/store and are not at /usr/bin.
+single_version_override(
+    module_name = "protobuf",
+    patch_strip = 1,
+    patches = [
+        "//bazel/protobuf:protobuf_use_default_shell_env.patch",
+    ],
+)
+
 ## rules_python
 bazel_dep(name = "rules_python", version = "1.2.0")
 

bazel/protobuf/BUILD.bazel

@@ -0,0 +1,16 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+exports_files(["protobuf_use_default_shell_env.patch"])

bazel/protobuf/protobuf_use_default_shell_env.patch

@@ -0,0 +1,10 @@
+--- a/editions/defaults.bzl
++++ b/editions/defaults.bzl
+@@ -70,6 +70,7 @@ def _embed_edition_defaults_impl(ctx):
+         fail("Unknown encoding %s" % ctx.attr.encoding)
+     ctx.actions.run_shell(
+         outputs = [ctx.outputs.output],
++        use_default_shell_env = True,
+         inputs = [ctx.file.defaults, ctx.file.template],
+         tools = [ctx.executable._escape],
+         command = """