* Ensure Bazel is available in self-hosted workflows
* Allow Bazel CI to use Command Line Tools
* Set macOS C++ deployment target for Bazel
* Use Bazel macOS minimum OS flags
* Raise macOS Bazel deployment target for filesystem
* Ensure git-lfs is available for CI fetches
* Authenticate CI LFS fetches with workflow token
* Disable stale LFS hooks during CI checkout
* Disable LFS filters during CI checkout
* Prepare Git LFS before persistent checkout
* Harden generated Bazel rc and LFS auth
* Let Xcode sync skip without full Xcode
* Harden Unity build cache markers
* Require full Xcode for mactools sync