Proposal: Flag-gated restriction on non-hermetic symlinks in build outputs

[thalha-a9]

Hey all,

I put up PR #30346 to validate relative symlink targets during remote execution — basically catching cases where a symlink traverses outside the exec root (think ../../../../../../etc/passwd). Right now Bazel only checks absolute symlinks via SymlinkAbsolutePathStrategy, but relative ones that escape the exec root slip through silently.

The PR got some good feedback and I realized my approach needs rethinking. Two main issues:

• I put the check in RemoteExecutionService.java, so it only fires for remote execution. Local execution still allows the same non-hermetic symlinks, which is inconsistent.
• There's no way to opt out, which would break anyone who intentionally uses symlinks pointing outside the build tree.

So before I rework the implementation, I wanted to get a sense of whether this is even worth doing. The idea would be:

1. Move the check to a shared layer so it applies to local and remote execution equally
2. Put it behind a flag (maybe --experimental_restrict_symlink_traversal) so it's opt-in
3. Keep respecting SymlinkAbsolutePathStrategy for absolute symlinks

Curious if anyone has workflows where this would cause problems, or thoughts on where the check should live architecturally. Happy to hear that it's not worth the effort too — just want to make sure before spending more time on it.

Related PR: #30346