Fix Bazel Xcode version caching in CI (#6309)

* Fix Bazel Xcode version caching causing CI build failures

When Xcode updates on self-hosted runners, Bazel's cached
local_config_xcode still references the old version, causing
"xcode-locator <old_version> failed" errors.

Add sync_bazel_xcode.sh which detects Xcode version changes
and runs `bazel sync --configure` to refresh the config without
nuking the build cache. Added to all 8 CI workflows that use Bazel.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Use rm of cached repo instead of bazel sync --configure

bazel sync --configure requires WORKSPACE mode and fails with
bzlmod. Instead, delete the stale local_config_xcode from the
output base directly — the next bazel build regenerates it.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Use bazel clean --expunge instead of targeted repo deletion

Deleting just local_config_xcode is insufficient — the stale Xcode
version is also embedded in cached actions and other toolchain repos.
The only reliable fix is a full expunge. Since Xcode updates are
infrequent, the one-time rebuild cost is acceptable.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Use action_env to bake Xcode version into cache keys

Instead of expunging the cache (which doesn't help with the remote
cache anyway), write the Xcode build version to .bazelrc.xcode via
--action_env. This makes the version part of every action's cache
key, so stale entries in both local and remote caches are naturally
ignored after an Xcode update — no deletion needed anywhere.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Add expunge back alongside action_env for belt-and-suspenders fix

action_env alone isn't enough — local_config_xcode is a cached
repository rule that bakes in the old Xcode version before any
actions run. Need expunge to clear the local toolchain config,
plus action_env to prevent stale remote cache hits afterward.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Add Xcode sync to mac_build build-and-sign job

The sync step was only in the deploy job, but build-and-sign calls
bazel via build_protos.sh before that. This runs on the unity-mac
runner which also has the stale Xcode cache.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

scripts/sync_bazel_xcode.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# Keeps Bazel in sync with the installed Xcode version. Two mechanisms:
+#
+# 1. Writes .bazelrc.xcode with --action_env=XCODE_BUILD_VERSION=<version>
+#    so the version is part of every action's cache key. This prevents stale
+#    remote cache entries from being reused after an Xcode update.
+#
+# 2. Runs `bazel clean --expunge` when the version actually changes, because
+#    local_config_xcode (a cached repository rule) bakes in the old version
+#    and can only be refreshed by clearing the output base.
+#
+# .bazelrc imports the generated file via: try-import %workspace%/.bazelrc.xcode
+
+set -euo pipefail
+
+XCODE_BUILD_VERSION=$(xcodebuild -version 2>/dev/null | awk '/Build version/ {print $3}')
+
+if [ -z "$XCODE_BUILD_VERSION" ]; then
+    echo "Warning: Could not detect Xcode build version, skipping"
+    exit 0
+fi
+
+BAZELRC_XCODE=".bazelrc.xcode"
+EXPECTED="common --action_env=XCODE_BUILD_VERSION=${XCODE_BUILD_VERSION}"
+
+# If the file already has the right version, nothing to do
+if [ -f "$BAZELRC_XCODE" ] && [ "$(cat "$BAZELRC_XCODE")" = "$EXPECTED" ]; then
+    exit 0
+fi
+
+# Xcode version changed (or first run) — expunge local cache to clear
+# stale local_config_xcode, then write the new version for remote cache keys
+OLD_VERSION="unknown"
+if [ -f "$BAZELRC_XCODE" ]; then
+    OLD_VERSION=$(sed -n 's/.*XCODE_BUILD_VERSION=//p' "$BAZELRC_XCODE")
+fi
+echo "Xcode build version changed: ${OLD_VERSION} -> ${XCODE_BUILD_VERSION}"
+echo "Running bazel clean --expunge to clear stale toolchain config..."
+bazel clean --expunge 2>/dev/null || true
+
+echo "$EXPECTED" > "$BAZELRC_XCODE"
+echo "Updated ${BAZELRC_XCODE} — next build will do a full rebuild with Xcode ${XCODE_BUILD_VERSION}"