fix: resolve Rust hermiticity issue with rules_cc fork (Issue #163)

## Solution

Use fork with auto_detect parameter to disable system C++ toolchain detection.

## Changes

1. Added git_override to use avrabe/rules_cc fork with fix
   - Commit: 7215331f9e53f80070dc01c4a95a0f9c53ea477b
   - Branch: feature/optional-cc-toolchain-auto-detect

2. Configured cc_configure with auto_detect = False
   - Prevents /usr/local/wasi-sdk from being detected
   - Generates empty toolchain instead of system paths

## Test Results

✅ Build successful (605 processes)
✅ Hermiticity test PASSED (401 actions analyzed, 0 issues)
✅ No system paths in generated toolchain config
✅ No /usr/local/wasi-sdk references

## Before vs After

Before:
- 86 hermiticity issues
- Hardcoded system WASI SDK linker paths
- 43 suspicious tool references

After:
- 0 hermiticity issues
- All tools from Bazel cache
- Empty toolchain config (no system detection)

## Upstream

This uses the fork temporarily until PR is accepted upstream:
- Fork: https://github.com/avrabe/rules_cc
- RFC: avrabe/rules_cc#1
- Verified: #163

Closes #163

Author: avrabe

MODULE.bazel

@@ -13,6 +13,13 @@ bazel_dep(name = "platforms", version = "1.0.0")
 bazel_dep(name = "rules_cc", version = "0.2.4")
 bazel_dep(name = "rules_go", version = "0.57.0")
 
+# Test optional auto-detection control (Issue #163)
+git_override(
+    module_name = "rules_cc",
+    remote = "https://github.com/avrabe/rules_cc.git",
+    commit = "7215331f9e53f80070dc01c4a95a0f9c53ea477b",
+)
+
 # OCI image signing capabilities
 bazel_dep(name = "rules_oci", version = "1.8.0")
 
@@ -99,6 +106,12 @@ wasi_sdk.register(
 )
 use_repo(wasi_sdk, "wasi_sdk")
 
+# Configure cc_configure to disable auto-detection (Issue #163)
+# This prevents system WASI SDK at /usr/local/wasi-sdk from being detected
+cc_configure = use_extension("@rules_cc//cc:extensions.bzl", "cc_configure_extension")
+cc_configure.configure(auto_detect = False)
+use_repo(cc_configure, "local_config_cc", "local_config_cc_toolchains")
+
 # Register both WASI SDK and C++ toolchains
 register_toolchains(
     "@wasi_sdk//:wasi_sdk_toolchain",