Fix NixOS specific build issues

[hazelnusse]

/bin/bash is unavailable on NixOS by default. This breaks many bazel assumptions and causes build failures such as:

  ...
  process-wrapper-legacy.cc:80: "execvp(/bin/bash, ...)": No such file or directory
  ...

By unsetting incompatible_strict_action_env 0, conditionally (on NixOS) setting shell_executable 1 to the bash in the Nix store, and by setting the bazel-wrapper PATH with
writeShellApplication.runtimeInputs we are able to avoid these errors.

Finally, tag several targets in //example as "manual" so they are not automatically built with the host toolchain, since this currently fails on NixOS. This should be addressed in a follow-up commit.

Testing was performed using nixpkgs supplied bazelisk 3 on Luke Peterson's and Michael Schneider's NixOS machines. This itself presented issues, as this package is documented with BEWARE: This package does not work on NixOS. Out of the box this is true, but can be worked around with programs.nix-ld.enable = true 4 in configuration.nix.

Special thanks to Oliver Lee and Michael Schneider during the final day of Nixcademy NixOS training. This was a great collaboration!

[hazelnusse]

@m1-s thank you for all your help on this! @oliverlee and I hacked on it for a few more hours after class and came up with a different strategy that seems to avoid a corner case we hit after class (and at this hour, I can't even remember what it was, but it was 🤯). If you have the time and inclination, we'd love to have your feedback but no worries if not! Thank you again!

[oliverlee]

The nix store path was only valid for linux-x86_64, so this would fail on other systems (e.g. darwin-aarch64).

[oliverlee]

Maybe update the develop section of the readme with NixOS config requirements.

It looks like forks don't have access to secrets. I'll try and fix that this weekend unless you do it before I do.

[hazelnusse]

The nix store path was only valid for linux-x86_64, so this would fail on other systems (e.g. darwin-aarch64).

Please take a look at how I did this and try on darwin-aarch64 to make sure you get an empty .nixos-autoconfig/bazelrc?

[oliverlee]

Thanks! No .nixos-autoconfig/bazelrc for me.

See inline comments and you'll need to sign your commit:
https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits

Does bazelisk run //tools:format work for you? I'm getting the following error in my NixOS VM:

INFO: Running command line: bazel-bin/tools/format.bash
/home/builder/.cache/bazel/_bazel_builder/98502806d288a25787a2b73a84a8c1a8/execroot/_main/bazel-out/aarch64-fastbuild/bin/tools/format.bash: line 19: /home/builder/.cache/bazel/_bazel_builder/98502806d288a25787a2b73a84a8c1a8/execroot/_main/bazel-out/aarch64-fastbuild/bin/tools/format.bash.runfiles/rules_multirun+/internal/multirun: cannot execute: required file not found

[oliverlee]

bazel run //tools:format currently doesn't work on NixOS.

The target is defined by the multirun rule which defines a Python script. rules_python is pulled in and configured to use a bootstrap script to provide the hermetic Python interpreter. It looks like the issue has already been fixed but we'll need to update the commit we use:
bazel-contrib/rules_python#3087