fix(IDX): add remap-path-prefix

[cgundy]

Analysis

Looking at your logs, the askama hypothesis is wrong — only 2 of 14 affected targets use askama. The real issue:
All 25 non-deterministic artifacts are .rlib files (Rust library archives). Each .rlib contains a .rmeta section where rustc embeds:
Absolute paths to source files
Absolute paths to dependency .rlib files in bazel-out/...

What's happening inside the .rlib file

Each .rlib is an ar archive containing:

1. Compiled object code (.o files)
2. .rmeta metadata — this is where the non-determinism comes from

The .rmeta section contains:

1. Source file paths (e.g., /home/runner/.cache/bazel/_bazel_runner/abc123/execroot/ic/rs/http_endpoints/public/src/lib.rs)
2. Dependency paths (e.g., paths to other .rlib files this crate depends on)
3. A Stable Crate ID computed from all the above

Root cause

Between your two builds (cache vs nocache), even though they produce outputs at the same relative path like bazel-out/k8-opt-ST-6bd88323ee24/bin/..., the absolute execution root path differs:

Build 1 (cache): /some/path/.cache/bazel/_bazel_runner/hash1/execroot/ic/bazel-out/k8-opt-ST-6bd88323ee24/bin/...
Build 2 (nocache): /different/path/.cache/bazel/_bazel_runner/hash2/execroot/ic/bazel-out/k8-opt-ST-6bd88323ee24/bin/...
These absolute paths get embedded in the .rmeta. Even though the relative structure (bazel-out/k8-opt-ST-6bd88323ee24/...) is identical, the full paths rustc embeds are different, causing different file contents → different SHA256.

Fix

The -Cremap-path-prefix=/proc/self/cwd=. strips the varying /some/path/.cache/bazel/_bazel_runner/hash/execroot/ic/ prefix, replacing it with ., so all builds produce identical .rmeta regardless of where the Bazel cache lives.