fix: python bootstrap uses relative paths

[lf-]

This got us good at Mercury and took down some builds when we enabled default_allow_cache_upload = true.

The primary bug: make_py_package_inplace writes a bootstrap script like so:

python = str(args.python)
if not os.path.isabs(python) and os.path.sep in python:
    python = os.path.abspath(python)

new_data = data.replace("<PYTHON>", f"/usr/bin/env {python}")

Absolutizing the interpreter path causes this to be a cache poisoning bug if ever uploaded. In our case, our python interpreter is an artifact, so it gets made absolute, thus baking our GitHub actions home directory into the uploaded actions.

This bug came from 5f5f692 (D79552056) which was endeavouring to make calling PARs not rely on the working directory anymore which it did successfully but via means it calls a "terrible idea".

Let's do this in a way that's not terrible.

Why didn't this hit Meta: the RE sandbox is always at /re_cwd, and the Python interpreter is usually(?) at an absolute path.

This also fixes a bug where allow_cache_upload (via cxx_attrs_get_allow_cache_upload) got dropped before hitting the PAR actions, so it's not even possible to turn it off on known non-hermetic actions.

The methodology behind this PR was that I told some agents to find how Bazel fixes this Python bootstrapping problem and learn all the footguns they hit.

One of their impls: https://github.com/bazel-contrib/rules_python/blob/16e167a5b269930f2f5000c4d9dc99b72f930f2b/python/private/pypi/venv_shebang_rewriter.sh

Here's a brief list:

1. !#/bin/bash is not compatible with NixOS: #!/usr/bin/env bash or #!/bin/sh is preferable.
2. Apparently Bazel has a bug with their wrappers' $0 where they got symlink handling wrong: it needs to walk component by component.
3. exec -a is not POSIX, so dash doesn't implement it. We have to use a sh -c trick instead.

You know the deal, the tests are vibed, you can throw them out or clean them up as desired, since I can't run them without being at fb.

Fixes: #1135
Fixes: #1268

[meta-codesync]

This pull request has been imported. If you are a Meta employee, you can view this in D114816218. (Because this pull request was imported automatically, there will not be any future comments.)

[8Keep]

Review automatically exported from Phabricator review in Meta.

[itamaro]

thanks for the PR @lf- !

I used this to "inspire" a slightly modified fix I'm landing internally now, focused on the relative paths issue.

I didn't include the cache upload fix, as it's unrelated to the relative paths fix - we will look into that as a separate fix to follow shortly.