Attribute every Bazel invocation through the shared NativeLink Action

[MarcusSorealheis]

Jobs that run multiple Bazel commands currently reuse one attribution ticket from .bazelrc. The NativeLink backend binds a ticket to one invocation, so later builds lose their GitHub identity. This change obtains a fresh, masked ticket when each Bazel invocation starts and leaves the shared RC free of tickets.

The main Action installs a launcher for ordinary bazel commands. A new attribution/ entry point lets repositories reuse the same implementation with an existing cache/BES setup. It exposes temporary files for Bazelisk hooks and BuildKit secret mounts, removes credentials in the post step, and skips cache-only forks. The backend's one-invocation binding remains intact. Python 3 is required when attribution is enabled.

NativeLink's CI adoption is tracked in TraceMachina/nativelink#2741. No backend deployment, MongoDB change, or individual contributor profile authorization is required. This PR does not change published tags; consumers can pin the reviewed commit until a release is published.

Validation

• All four GitHub CI checks pass on 7c6a05e.
• 32 TypeScript tests pass; type checking, ESLint (existing helper-test warnings only), Prettier, and actionlint pass.
• 10 Python tests pass, including parallel invocations, startup options, run -- arguments, unchanged RC contents, failure/strict behavior, malformed tickets, and credential-bearing redirect rejection.
• The packaged-bundle test executes the actual Action, launches two fake Bazel processes through its installed launcher with distinct tickets, and verifies post-job credential cleanup. Its HTTP transport is mocked; it does not claim live service verification.
• Regenerated all executable bundles, source maps, and coverage badge. Packaging uses Node 24's native TypeScript-config loading to avoid leaving the extra config compiler running after the bundle is written.

How to test

1. Install/connect the GitHub App and enable the test repository in NativeLink. Use an existing valid BES/cache configuration and grant the job permissions: { contents: read, id-token: write }.
2. Pin this Action commit. Set attribution_url to the deployment's GitHub App origin; for the attribution-only entry point, set bazelrc to the existing RC file. Install Bazel and Python 3 before running the Action.
3. Run two bazel build/bazel test commands in the same job. Verify both invocation records and UI pages show the repository and workflow actor, plus the separate PR author when applicable. Repeat for a merge-triggered build.
4. Confirm cache-only forks upload no BES and request no attribution. Verify an unavailable exchange warns and preserves the build by default, while fail_on_attribution_error: true stops the invocation.

Local checks: pnpm ci-test, pnpm package, and python3 -m unittest discover -s scripts -v.