fix(toolchain): build unpack binary in exec config to prevent ELF-on-macOS failure

[gregmagolan]

Problem

After #905 removed resolved_unpack_toolchain, macOS builds fail when the dependency graph contains a platform_transition_filegroup targeting Linux (e.g. OCI crossbuild tests):

bazel-out/darwin_arm64-opt-ST-.../bin/py/tools/unpack_bin/unpack: cannot execute binary file

The unpack binary is ELF (Linux x86-64) instead of Mach-O (darwin-arm64).

Root cause

Bazel analyzes toolchain targets in the same configuration as the requesting rule. When a platform_transition_filegroup transitions to a Linux target platform, whl_install is analyzed in that Linux-targeted configuration. With no cfg on the bin attribute of py_tool_toolchain, the unpack binary inherits that Linux target config and is compiled as ELF — which cannot execute on the macOS exec host.

resolved_unpack_toolchain worked around this by being a regular dep with cfg = "exec", explicitly pulling the binary into exec config. The goal of #905 was to remove that workaround, but doing so exposed the underlying issue.

Fix

Introduce two source-toolchain rule variants with explicit cfg on their bin attribute:

• source_target_py_tool_toolchain — cfg = "target" (venv, shim: target-side tools placed in runfiles)
• source_exec_py_tool_toolchain — cfg = "exec" (unpack: runs on the exec host during the build)

TOOL_CFGS is already the source of truth for which tools are exec-side (cfg = "exec") vs target-side. The source_toolchain macro now looks up the cfg from TOOL_CFGS by name and selects the appropriate rule variant automatically — no per-call parameter needed.

Note: these source_* rules are only active when IS_PRERELEASE = True (i.e. in this repo during development). Consumers get pre-built binaries via prebuilt_tool_repo, which uses exec_compatible_with on the toolchain() declaration for correct host selection.

[aspect-workflows]

Bazel 8 (Test)

All tests were cache hits

111 tests (100.0%) were fully cached saving 40s.

---

Bazel 9 (Test)

All tests were cache hits

111 tests (100.0%) were fully cached saving 40s.

---

Bazel 8 (Test)

e2e

All tests were cache hits

51 tests (100.0%) were fully cached saving 55s.

---

Bazel 9 (Test)

e2e

All tests were cache hits

51 tests (100.0%) were fully cached saving 43s.

---

Bazel 8 (Test)

examples/uv_pip_compile

All tests were cache hits

1 test (100.0%) was fully cached saving 444ms.

[CLAassistant]

All committers have signed the CLA.