feat(build): migrated native pipeline to bazel with remote caching

- Replaced the napi-cli/cargo-zigbuild/cargo-xwin/sccache build path with
  Bazel: rules_rust + crate_universe over Cargo.lock, hermetic zig cc
  toolchains (linux-gnu pinned to glibc 2.17, linux-musl), host Xcode for
  darwin, and a repo-local hermetic clang-cl + llvm-ml + xwin toolchain for
  windows-msvc (bazel/toolchains/msvc).
- All eight shipped addons build as //:natives-<target> via the release
  transition in bazel/defs.bzl (opt, thin LTO, cgu=16, stripped, canonical
  .node naming); scripts/bazel-natives.ts is the single driver for local
  dev and CI.
- Rust validation moved to bazel test + clippy aspects (strict workspace
  policy for opted-in crates, default lints elsewhere, mirroring cargo
  semantics) and the rustfmt aspect; cargo stays as the dev-iteration
  surface, with brush-core/brush-builtins promoted to workspace members
  and excluded from cargo dev tasks to keep their historical scope.
- CI caches through an in-cluster bazel-remote action cache (TLS + basic
  auth, cluster-internal only); GitHub-hosted runners never touch the
  infrastructure and use an actions/cache-backed disk cache instead.
- Deleted the hand-rolled caching machinery: ci-target-cache,
  ci-native-artifact-cache, ci-build-native, native-source-hash,
  find-native-artifacts, restore-linux-native, native-prewarm workflow,
  ensure-* toolchain actions, and all sccache/Swatinem wiring.
- Warm native rebuilds drop from ~20 minutes to seconds; a cold client
  with a warm remote cache rebuilds the linux x64 pair in ~2.5 minutes.

.github/actions/bazel-natives/action.yml

@@ -0,0 +1,34 @@
+name: "Build native addons (bazel)"
+description: >
+   Build the requested //:natives-* targets with bazelisk and copy the .node
+   files into the destination directory. Cache wiring comes from the
+   bazel-cache action: in-cluster read-write on omp-kata, actions/cache-backed
+   disk cache on GitHub-hosted runners.
+
+inputs:
+   targets:
+      description: Space-separated scripts/bazel-natives.ts target names
+      required: true
+   dest:
+      description: Destination directory for the .node files
+      required: false
+      default: packages/natives/native
+   cache-scope:
+      description: Disk-cache key discriminator (see bazel-cache action)
+      required: false
+      default: natives
+
+runs:
+   using: composite
+   steps:
+      - id: cache
+        uses: ./.github/actions/bazel-cache
+        with:
+           scope: ${{ inputs.cache-scope }}
+
+      - name: Build native addons
+        shell: bash
+        run: |
+           set -euo pipefail
+           export OMP_BAZEL_RC="${{ steps.cache.outputs.rc }}"
+           bun scripts/bazel-natives.ts ${{ inputs.targets }} --dest "${{ inputs.dest }}"