refactor: eliminate shared dependency workspace and simplify toolchain approach

- Remove shared bazel_tools_deps directory that caused version conflicts
- Implement separate crate_universe workspace for wasmsign2 (Bazel-native rust_binary)
- Revert wizer and wasm-tools to use proven download strategy (hermetic binaries)
- Remove unused legacy toolchain files (BUILD.hermetic, BUILD.nixpkgs, etc.)
- Fix cpp_component_toolchain missing function and wasi_sdk extension issues
- Clean up 5 unused BUILD files and 1 unused .bzl file following RULE #1: THE BAZEL WAY FIRST

Strategy now follows proven patterns:
- wasmsign2: Bazel-native build with separate dependency resolution ✅
- wizer: Download strategy (hermetic pre-built binaries) ✅
- wasm-tools: Download strategy (hermetic pre-built binaries) ✅

Author: avrabe

MODULE.bazel

@@ -107,7 +107,7 @@ register_toolchains("@tinygo_toolchain//:tinygo_toolchain_def")
 wizer = use_extension("//wasm:extensions.bzl", "wizer")
 wizer.register(
     name = "wizer",
-    strategy = "build",
+    strategy = "download",
     version = "9.0.0",
 )
 use_repo(wizer, "wizer_toolchain")
@@ -187,30 +187,25 @@ crate.from_cargo(
     ],
 )
 crate.from_cargo(
-    name = "bazel_tools_crates",
-    cargo_lockfile = "//toolchains/bazel_tools_deps:Cargo.lock",
-    manifests = ["//toolchains/bazel_tools_deps:Cargo.toml"],
+    name = "wasmsign2_crates",
+    manifests = ["@wasmsign2_src//:Cargo.toml"],
     supported_platform_triples = [
         "x86_64-unknown-linux-gnu",
         "aarch64-unknown-linux-gnu",  # BCR environment ARM64 Linux
         "aarch64-apple-darwin",
         "x86_64-pc-windows-msvc",
     ],
 )
-use_repo(crate, "bazel_tools_crates", "crates", "wizer_crates")
+use_repo(crate, "crates", "wasmsign2_crates", "wizer_crates")
 
 # Modernized WASM tool repositories using git_repository + rules_rust
 wasm_tool_repos = use_extension("//toolchains:extensions.bzl", "wasm_tool_repositories")
 use_repo(
     wasm_tool_repos,
     "wac_src",
     "wasm_tools_src",
+    "wasmsign2_src",
     "wit_bindgen_src",
     "wizer_src",
     "wrpc_src",
 )
-
-# Hermetic WebAssembly tools via http_archive using checksum registry
-wasm_hermetic = use_extension("//toolchains:hermetic_extension.bzl", "wasm_hermetic")
-wasm_hermetic.register()
-use_repo(wasm_hermetic, "wac_hermetic", "wasm_tools_hermetic", "wasmtime_hermetic", "wit_bindgen_hermetic", "wkg_hermetic")

toolchains/BUILD.bazel

@@ -188,63 +188,3 @@ toolchain(
     toolchain = ":wasm_tools_component_toolchain_impl",
     toolchain_type = ":wasm_tools_component_toolchain_type",
 )
-
-# Hermetic WebAssembly toolchain using pre-built binaries
-# These tools are downloaded via http_archive in the hermetic_extension
-
-# Create filegroups for easy access to the hermetic tools
-filegroup(
-    name = "wasm_tools_hermetic_filegroup",
-    srcs = ["@wasm_tools_hermetic//:bin"],
-    visibility = ["//visibility:public"],
-)
-
-filegroup(
-    name = "wasmtime_hermetic_filegroup",
-    srcs = ["@wasmtime_hermetic//:bin"],
-    visibility = ["//visibility:public"],
-)
-
-filegroup(
-    name = "wit_bindgen_hermetic_filegroup",
-    srcs = ["@wit_bindgen_hermetic//:bin"],
-    visibility = ["//visibility:public"],
-)
-
-filegroup(
-    name = "wac_hermetic_filegroup",
-    srcs = ["@wac_hermetic//file"],
-    visibility = ["//visibility:public"],
-)
-
-filegroup(
-    name = "wkg_hermetic_filegroup",
-    srcs = ["@wkg_hermetic//file"],
-    visibility = ["//visibility:public"],
-)
-
-# Maintain backwards compatibility with simpler names
-alias(
-    name = "wasm_tools_hermetic",
-    actual = ":wasm_tools_hermetic_filegroup",
-)
-
-alias(
-    name = "wasmtime_hermetic",
-    actual = ":wasmtime_hermetic_filegroup",
-)
-
-alias(
-    name = "wit_bindgen_hermetic",
-    actual = ":wit_bindgen_hermetic_filegroup",
-)
-
-alias(
-    name = "wac_hermetic",
-    actual = ":wac_hermetic_filegroup",
-)
-
-alias(
-    name = "wkg_hermetic",
-    actual = ":wkg_hermetic_filegroup",
-)

toolchains/BUILD.wasm_tools

@@ -1,58 +1,10 @@
 """BUILD file for wasm-tools repository
 
-This file creates wasm-tools binary using both cargo (legacy) and Bazel-native rust_binary.
-The rust_binary approach eliminates cargo sandbox issues.
+This file creates wasm-tools binary using cargo build with download strategy.
+The download strategy provides hermetic builds without complex workspace dependencies.
 """
 
-load("@rules_rust//rust:defs.bzl", "rust_binary", "rust_library")
-
-# Bazel-native rust_binary build (NEW: eliminates cargo sandbox issues)
-rust_binary(
-    name = "wasm_tools_bazel",
-    srcs = [
-        "src/bin/wasm-tools/main.rs",
-    ],
-    crate_name = "wasm_tools",
-    edition = "2021",
-    deps = [
-        ":wasm_tools_lib",
-    ],
-    visibility = ["//visibility:public"],
-)
-
-# Supporting library crate for Bazel-native build
-rust_library(
-    name = "wasm_tools_lib",
-    srcs = glob([
-        "src/**/*.rs",
-    ], exclude = [
-        "src/bin/**/*.rs",
-    ]),
-    crate_name = "wasm_tools",
-    edition = "2021",
-    deps = [
-        # Use dependencies from bazel_tools_crates
-        "@bazel_tools_crates//:anyhow",
-        "@bazel_tools_crates//:clap",
-        "@bazel_tools_crates//:env_logger",
-        "@bazel_tools_crates//:log",
-        "@bazel_tools_crates//:serde",
-        "@bazel_tools_crates//:serde_json",
-        "@bazel_tools_crates//:termcolor",
-        "@bazel_tools_crates//:wat",
-        "@bazel_tools_crates//:wasm-encoder",
-        "@bazel_tools_crates//:wasmparser",
-        "@bazel_tools_crates//:wasmprinter",
-        "@bazel_tools_crates//:wasm-mutate",
-        "@bazel_tools_crates//:wasm-shrink",
-        "@bazel_tools_crates//:wasm-smith",
-        "@bazel_tools_crates//:wit-parser",
-        "@bazel_tools_crates//:wit-component",
-    ],
-    visibility = ["//visibility:public"],
-)
-
-# Legacy cargo build (for backward compatibility)
+# Cargo build for wasm-tools
 genrule(
     name = "wasm_tools_cargo",
     srcs = glob(["**/*"]),  # All source files

toolchains/BUILD.wasmsign2

@@ -0,0 +1,70 @@
+"""BUILD file for wasmsign2 repository
+
+This file creates wasmsign2 binary using both cargo (legacy) and Bazel-native rust_binary.
+The rust_binary approach eliminates cargo sandbox issues and provides true hermeticity.
+"""
+
+load("@rules_rust//rust:defs.bzl", "rust_binary", "rust_library")
+
+# Bazel-native rust_binary build (NEW: eliminates cargo sandbox issues)
+rust_binary(
+    name = "wasmsign2_bazel",
+    srcs = [
+        "src/cli/main.rs",
+    ],
+    crate_name = "wasmsign2",
+    edition = "2021",
+    deps = [
+        ":wasmsign2_lib",
+        # CLI-specific dependencies from wasmsign2 CLI Cargo.toml
+        "@wasmsign2_crates//:clap",
+        "@wasmsign2_crates//:env_logger",
+        "@wasmsign2_crates//:regex",
+        "@wasmsign2_crates//:ureq",
+        "@wasmsign2_crates//:uri_encode",
+    ],
+    visibility = ["//visibility:public"],
+)
+
+# Supporting library crate for Bazel-native build
+rust_library(
+    name = "wasmsign2_lib",
+    srcs = glob([
+        "src/lib/src/**/*.rs",
+    ]),
+    crate_root = "src/lib/src/lib.rs",
+    crate_name = "wasmsign2",
+    edition = "2021",
+    deps = [
+        # Core dependencies from wasmsign2 library Cargo.toml
+        "@wasmsign2_crates//:anyhow",
+        "@wasmsign2_crates//:ct-codecs",
+        "@wasmsign2_crates//:ed25519-compact",
+        "@wasmsign2_crates//:getrandom",
+        "@wasmsign2_crates//:hmac-sha256",
+        "@wasmsign2_crates//:log",
+        "@wasmsign2_crates//:regex",
+        "@wasmsign2_crates//:ssh-keys",
+        "@wasmsign2_crates//:thiserror",
+    ],
+    visibility = ["//visibility:public"],
+)
+
+# Legacy cargo build (for backward compatibility during transition)
+genrule(
+    name = "wasmsign2",
+    srcs = glob(["**/*"]),  # All source files
+    outs = ["wasmsign2"],
+    cmd = """cd $$(dirname $(location Cargo.toml)) && \
+             cargo build --release --bin wasmsign2 && \
+             cp target/release/wasmsign2 $(location wasmsign2)""",
+    visibility = ["//visibility:public"],
+    tags = ["requires-network"],  # Cargo may need to fetch dependencies
+)
+
+# Export the legacy binary for toolchain use
+filegroup(
+    name = "wasmsign2_binary",
+    srcs = [":wasmsign2"],
+    visibility = ["//visibility:public"],
+)

toolchains/BUILD.wizer

@@ -1,50 +1,10 @@
 """BUILD file for wizer repository
 
-This file creates wizer binary using both cargo (legacy) and Bazel-native rust_binary.
-The rust_binary approach eliminates cargo sandbox issues.
+This file creates wizer binary using cargo build with download strategy.
+The download strategy provides hermetic builds without complex workspace dependencies.
 """
 
-load("@rules_rust//rust:defs.bzl", "rust_binary", "rust_library")
-
-# Bazel-native rust_binary build (NEW: eliminates cargo sandbox issues)
-rust_binary(
-    name = "wizer_bazel",
-    srcs = [
-        "src/bin/wizer.rs",
-    ],
-    crate_name = "wizer",
-    edition = "2021",
-    deps = [
-        ":wizer_lib",
-    ],
-    visibility = ["//visibility:public"],
-)
-
-# Supporting library crate for Bazel-native build
-rust_library(
-    name = "wizer_lib",
-    srcs = glob([
-        "src/**/*.rs",
-    ], exclude = [
-        "src/bin/**/*.rs",
-    ]),
-    crate_name = "wizer",
-    edition = "2021",
-    deps = [
-        # Use dependencies from bazel_tools_crates
-        "@bazel_tools_crates//:anyhow",
-        "@bazel_tools_crates//:clap",
-        "@bazel_tools_crates//:env_logger",
-        "@bazel_tools_crates//:log",
-        "@bazel_tools_crates//:wasmtime",
-        "@bazel_tools_crates//:wasmtime-wasi",
-        "@bazel_tools_crates//:wasm-encoder",
-        "@bazel_tools_crates//:wasmparser",
-    ],
-    visibility = ["//visibility:public"],
-)
-
-# Legacy cargo build (for backward compatibility)
+# Cargo build for wizer
 genrule(
     name = "wizer",
     srcs = glob(["**/*"]),  # All source files