Baseline: e2e4c35d7400a1f3cdf3e337bb53e4fa0eafd001

Important changes:

  - Starlark `fail()` calls now format error messages with `Error: `
    instead of `Error in fail: `.
    Resolves https://github.com/bazelbuild/bazel/issues/21523.
  - Aquery now supports the `config(expr, word)` function.
  - Fixed unnecessary remote-cache hits in incremental BwoB builds
    after a previous invocation used a broader remote output download
    policy.
  - Fix an issue on Windows where empty environment variables (e.g.
    `--action_env=VAR=`) caused test execution failures in the test
    wrapper.
  - `--experimental_override_platform_cpu_name` renamed to
    `--override_platform_cpu_name`
  - The macOS sandbox now allows actions to bind sockets when network
    access is blocked, matching the behavior of the Linux sandbox.
    Note that macOS cannot restrict inbound connections by peer, so
    an action that listens on a non-loopback address is reachable
    from other hosts on the network; outbound traffic remains
    restricted to loopback.
  - Clean up unused stashed sandbox directories when shutting down
    the Bazel server.
  - Downloader rewrites to endpoints that refuse connections no
    longer repeat the connector's full retry sequence.
  - Fix `grep: invalid option -- P` errors on macOS when running
    release and documentation scripts.
  - Remote execution, remote caching, and auth flags can now be reset
    to their default unset state on the command line by passing an
    empty value (e.g., `--remote_cache=`, `--remote_executor=`,
    `--google_credentials=`).

This release contains contributions from many people at Google, as well as Alex Eagle, Angus Lees, Armando Montanez, Fabian Meumertzheim, Fabian Meumertzheim, Henner Zeller, jjj-n, Jonathan Perry, justinswe, Keith Smiley, Kip Hamiltons, Salma Samy, Samuel Bronson, Tyler Breisacher, zozo123.