Inline dd-procmgrd Bazel build into omnibus packaging (#46834)

### What does this PR do?
Remove the dedicated `binary_build` stage jobs (`build_dd-procmgrd-{x64,arm64}`) that built the `dd-procmgrd` Rust binary, archived it as a GitLab artifact, and passed it to the packaging stage via `--dd-procmgrd-bin=...` (`DD_PROCMGRD_BIN=...` from omnibus perspective).

Instead, the build is triggered directly from within the omnibus software definition via `bazel run //pkg/procmgr/rust:install` when `--with-dd-procmgrd` is passed (`WITH_DD_PROCMGRD=true` from omnibus perspective).

### Motivation
Bazel in CI operates with two caching layers: a minimal GitLab cache for bootstrapping pre-fetched external repositories (read-only in PR branches, read/write on `main`), and an always-on remote cache, so any target built with identical inputs is fetched rather than rebuilt.

An orthogonal GitLab artifact carrying the same binary is therefore redundant: it imposes a fixed pack/upload/download/unpack overhead on every run, including those that would otherwise be remote cache hits, and introduces an inter-stage dependency that serializes the pipeline.

Running the build at the point of consumption lets Bazel's DAG do the right thing: unchanged sources yield a near-instant cache hit; if sources differ, the cost is paid once and cached for all subsequent runs.

### Describe how you validated your changes
CI.

Co-authored-by: regis.desgroppes <regis.desgroppes@datadoghq.com>

Author: rdesgroppes

.github/CODEOWNERS

@@ -128,7 +128,6 @@
 /.gitlab/build/binary_build/fakeintake.yml                 @DataDog/agent-devx
 /.gitlab/build/binary_build/host_profiler.yml              @DataDog/opentelemetry-agent @DataDog/profiling-full-host @DataDog/agent-build
 /.gitlab/build/binary_build/system_probe.yml               @DataDog/ebpf-platform @DataDog/agent-build
-/.gitlab/build/binary_build/dd_procmgrd.yml               @DataDog/agent-runtimes @DataDog/agent-build
 /.gitlab/build/binary_build/windows.yml                    @DataDog/agent-build @DataDog/windows-products
 
 /.gitlab/build/source_test/codeql_scan.yml                 @DataDog/sdlc-security

.gitlab/JOBOWNERS

@@ -37,7 +37,6 @@ golang_deps_commenter                @DataDog/agent-runtimes
 # Binary build
 build_system-probe*                  @DataDog/ebpf-platform
 build_sd-agent*                      @DataDog/agent-discovery
-build_dd-procmgrd*                   @DataDog/agent-runtimes
 cluster_agent_cloudfoundry-build*    @Datadog/agent-integrations
 cluster_agent-build*                 @DataDog/container-integrations
 cluster_agent_fips-build*            @DataDog/container-integrations

.gitlab/build/binary_build/dd_procmgrd.yml

@@ -16,17 +16,14 @@
   - mkdir -p /tmp/sd-agent
   - cp $CI_PROJECT_DIR/sd-agent-build-outputs/sd-agent /tmp/sd-agent/sd-agent
   - chmod 0755 /tmp/sd-agent/sd-agent
-  # Extract dd-procmgrd pre-built binary
-  - tar -xf $CI_PROJECT_DIR/dd-procmgrd-build-outputs.tar.xz
-  - mkdir -p /tmp/dd-procmgrd
-  - cp $CI_PROJECT_DIR/dd-procmgrd-build-outputs/dd-procmgrd /tmp/dd-procmgrd/dd-procmgrd
-  - chmod 0755 /tmp/dd-procmgrd/dd-procmgrd
-  - dda inv -- -e omnibus.build --base-dir $OMNIBUS_BASE_DIR --skip-deps --go-mod-cache="$GOPATH/pkg/mod" --system-probe-bin=/tmp/system-probe --sd-agent-bin=/tmp/sd-agent/sd-agent --dd-procmgrd-bin=/tmp/dd-procmgrd/dd-procmgrd --flavor "$FLAVOR" --config-directory "$CONFIG_DIR" --install-directory "$INSTALL_DIR"
+  - dda inv -- -e omnibus.build --base-dir $OMNIBUS_BASE_DIR --skip-deps --go-mod-cache="$GOPATH/pkg/mod" --system-probe-bin=/tmp/system-probe --sd-agent-bin=/tmp/sd-agent/sd-agent --with-dd-procmgrd --flavor "$FLAVOR" --config-directory "$CONFIG_DIR" --install-directory "$INSTALL_DIR"
   - ls -la $OMNIBUS_PACKAGE_DIR
   - !reference [.upload_sbom_artifacts]
 
 .agent_build_common:
-  extends: .bazel:defs:cache:omnibus-transition
+  extends:
+    - .bazel:defs:cache:omnibus-transition
+    - .rust_internal_registry  # TODO(agent-build): bazelify
   rules:
     - !reference [.except_mergequeue]
     - when: on_success
@@ -45,7 +42,7 @@
 .agent_build_x86:
   image: registry.ddbuild.io/ci/datadog-agent-buildimages/linux$CI_IMAGE_LINUX_SUFFIX:$CI_IMAGE_LINUX
   tags: ["arch:amd64", "specific:true"]
-  needs: ["build_system-probe-x64", "build_sd-agent-x64", "build_dd-procmgrd-x64", "go_deps", "generate_minimized_btfs_x64"]
+  needs: ["build_system-probe-x64", "build_sd-agent-x64", "go_deps", "generate_minimized_btfs_x64"]
   variables:
     PACKAGE_ARCH: amd64
     DD_CC: "x86_64-unknown-linux-gnu-gcc"
@@ -56,7 +53,7 @@
   image: registry.ddbuild.io/ci/datadog-agent-buildimages/linux$CI_IMAGE_LINUX_SUFFIX:$CI_IMAGE_LINUX
   tags: ["arch:arm64", "specific:true"]
   needs:
-    ["build_system-probe-arm64", "build_sd-agent-arm64", "build_dd-procmgrd-arm64", "go_deps", "generate_minimized_btfs_arm64"]
+    ["build_system-probe-arm64", "build_sd-agent-arm64", "go_deps", "generate_minimized_btfs_arm64"]
   variables:
     PACKAGE_ARCH: arm64
     DD_CC: "aarch64-unknown-linux-gnu-gcc"

.gitlab/build/package_build/linux.yml

@@ -219,8 +219,8 @@
   end
 
   # dd-procmgrd (process manager daemon)
-  if ENV['DD_PROCMGRD_BIN'] && linux_target?
-    copy ENV['DD_PROCMGRD_BIN'], "#{install_dir}/embedded/bin/dd-procmgrd"
+  if ENV['WITH_DD_PROCMGRD'] == 'true'
+    command_on_repo_root "bazel run --config=dd-procmgrd-release //pkg/procmgr/rust:install -- --destdir=#{install_dir}/embedded/bin", :env => env, :live_stream => Omnibus.logger.live_stream(:info)
   end
 
   # Security agent

omnibus/config/software/datadog-agent.rb

@@ -86,7 +86,7 @@ def get_omnibus_env(
     hardened_runtime=False,
     system_probe_bin=None,
     sd_agent_bin=None,
-    dd_procmgrd_bin=None,
+    with_dd_procmgrd=False,
     go_mod_cache=None,
     flavor=AgentFlavor.base,
     pip_config_file="pip.conf",
@@ -141,8 +141,8 @@ def get_omnibus_env(
         env['SYSTEM_PROBE_BIN'] = system_probe_bin
     if sd_agent_bin:
         env['SD_AGENT_BIN'] = sd_agent_bin
-    if dd_procmgrd_bin:
-        env['DD_PROCMGRD_BIN'] = dd_procmgrd_bin
+    if with_dd_procmgrd:
+        env['WITH_DD_PROCMGRD'] = 'true'
     env['AGENT_FLAVOR'] = flavor.name
 
     if custom_config_dir:
@@ -208,7 +208,7 @@ def build(
     hardened_runtime=False,
     system_probe_bin=None,
     sd_agent_bin=None,
-    dd_procmgrd_bin=None,
+    with_dd_procmgrd=False,
     go_mod_cache=None,
     python_mirror=None,
     pip_config_file="pip.conf",
@@ -242,7 +242,7 @@ def build(
         hardened_runtime=hardened_runtime,
         system_probe_bin=system_probe_bin,
         sd_agent_bin=sd_agent_bin,
-        dd_procmgrd_bin=dd_procmgrd_bin,
+        with_dd_procmgrd=with_dd_procmgrd,
         go_mod_cache=go_mod_cache,
         flavor=flavor,
         pip_config_file=pip_config_file,
@@ -387,7 +387,7 @@ def manifest(
     hardened_runtime=False,
     system_probe_bin=None,
     sd_agent_bin=None,
-    dd_procmgrd_bin=None,
+    with_dd_procmgrd=False,
     go_mod_cache=None,
 ):
     flavor = AgentFlavor[flavor]
@@ -400,7 +400,7 @@ def manifest(
         hardened_runtime=hardened_runtime,
         system_probe_bin=system_probe_bin,
         sd_agent_bin=sd_agent_bin,
-        dd_procmgrd_bin=dd_procmgrd_bin,
+        with_dd_procmgrd=with_dd_procmgrd,
         go_mod_cache=go_mod_cache,
         flavor=flavor,
     )