fix(build): isolated zig compile caches to stop concurrent corruption

zig 0.14's cache corrupts under concurrent `zig cc` (ziglang/zig#18763):
with ~60 cc-compiling cargo build scripts running in parallel, cache
manifests end up referencing evicted objects ("failed to open
.../scanner.o: FileNotFound") and kill the build. Patch the hermetic
wrapper via single_version_override so compile-only steps (-c/-E/-S) get
private throwaway caches under the system tmp dir — cold vs warm is
~25ms for compiles, measured — while links keep the shared cache for
compiler-rt/crt reuse (~6s cold, 25ms warm) under zig's per-artifact
locking.

MODULE.bazel

@@ -23,6 +23,15 @@ bazel_dep(name = "platforms", version = "1.1.0")
 bazel_dep(name = "rules_rust", version = "0.71.3")
 bazel_dep(name = "hermetic_cc_toolchain", version = "4.2.0")
 
+# zig 0.14's cache corrupts under concurrent `zig cc` (ziglang/zig#18763);
+# the patch gives compile-only steps private throwaway caches while links
+# keep the shared cache. See the patch header for measurements.
+single_version_override(
+    module_name = "hermetic_cc_toolchain",
+    patch_strip = 1,
+    patches = ["//bazel/patches:hermetic_cc_toolchain-isolated-compile-cache.patch"],
+)
+
 # --- Rust toolchains ----------------------------------------------------------
 rust = use_extension("@rules_rust//rust:extensions.bzl", "rust")
 rust.toolchain(