Capture compact Bazel execution logs

[karim-alweheshy]

Summary

• Capture Bazel's compact execution log for proxy-owned builds instead of the larger JSON execution stream.
• Keep metadata capture opt-in through the existing per-operation private path.
• Neutralize JSON and binary execution-log settings inherited from user, common, and configuration bazelrc sections so the proxy-owned compact path wins deterministically.
• Keep the metadata-only aquery from creating or overwriting any execution log, and filter current and legacy execution-log plumbing from the publishable invocation receipt.
• Preserve mode-0600 evidence handling and fail closed when the expected artifact is absent.

Stack

• Depends on #3327.
• Companion decoder: karim-alweheshy/XCBBuildServiceProxyKit#9.
• Part of #1953.

Validation

• Focused launcher test passes normally and with --ignore_all_rc_files.
• Bash syntax, scoped ShellCheck, Buildifier, git diff --check, and secret scanning pass.
• A real Bazel 9.2.0 temporary-bazelrc negative control reproduced the multiple execution-log-format error when common --execution_log_json_file and build --execution_log_binary_file met the proxy compact flag.
• The candidate build passed with explicit JSON/binary clears, produced only the private compact artifact, and did not create either user-specified artifact. The same aquery failed without clears and passed with all three formats explicitly cleared after the named config.
• A same-target smoke test with a path containing spaces produced a mode-0600 zstd compact artifact. Tiny-target observation: compact artifact 0.5 KB versus JSON control 1.8 KB. This is not a production performance claim.
• Xcode 26.5 live acceptance passed with the exact companion proxy binary: the selected report showed 18 Bazel actions—4 executed, 3 completed with unavailable cache status, and 11 up to date—with native-style Compile, Archive, Link, and Assemble rows.

Review notes

• Only the actual build receives a nonempty --execution_log_compact_file; its command-line JSON/binary clears override inherited bazelrc values.
• The follow-up configured-action query filters metadata flags from replayed arrays and passes empty compact, JSON, and binary options after --config, so direct bazelrc settings cannot leak into the query.
• Production-scale latency/CPU/RSS remains an explicit release gate. Live Xcode functional acceptance is complete for this slice.