tooling: extract the compile DB in the develop config (--config=clang-tidy)

[helly25]

Adopts helly25/mbo#280's root-cause approach: extract compile_commands.json in the exact configuration we develop in, instead of the default build config with a post-hoc compiler substitution.

Change

• New .bazelrc clang-tidy config: --config=clang + explicit --cxxopt=-stdlib=libc++ / --linkopt=-stdlib=libc++.
• compile_commands-update.sh extracts under it (--config=clang-tidy passed as a runtime flag; the hedron fork forwards non---bcce-* runtime args to its internal aquery), and materializes generated / virtual-include headers in the same config so the forests land where the DB points.

So clang-tidy / clangd parse with the compiler, standard library, include paths and feature macros the real --config=clang builds use - not whatever toolchain bazel would autodetect (libc++ on macOS, system libstdc++ on Linux).

Two xff-specific deviations from mbo#280

1. Keep --bcce-compiler. xff's toolchain names cc_wrapper.sh as the compiler in the extracted command, not a real clang++. clang-tidy reads that leading token to derive the driver's target + resource dir; a shell script leaves it with the wrong builtins, so SDK / libc++ headers fail to parse. Substituting the hermetic clang++ binary fixes it - all other flags still come from the config.
2. macOS: drop the SDK libc++ redirection. macOS toolchains_llvm emits -nostdinc++ -cxx-isystem <SDK>/usr/include/c++/v1 (Xcode's libc++) while -resource-dir is the hermetic clang's. That mismatch silently degrades clang-tidy's analysis (spurious unused-variable / const-correctness findings on clearly-used variables). The hermetic clang++ finds its own libc++ by default, so a uname-gated post-filter drops just those two flags; -isysroot stays for the system C headers. Linux never emits the SDK -cxx-isystem, so the filter is a no-op there.

Test

• DB regenerated locally: 2042 entries, compiler is the hermetic clang++, -stdlib=libc++ and -isysroot present, SDK -cxx-isystem/-nostdinc++ gone.
• pre-commit run clang-tidy parses the tree clean (the const/internal-linkage findings that appeared mid-investigation were artifacts of the broken parse and are gone once the DB is healthy).
• pre-commit run green on the changed files (shfmt / shellcheck / actionlint / yaml).

The CI compile-DB build step exercises the Linux path of the new script (the macOS filter is gated off there).