ci: enforce the hermetic Windows Bazel toolchain

[anp-oai]

Motivation

Make the Windows Bazel hermeticity boundary fail closed after the gnullvm execution and native-build migrations in #29162.

Implementation

• remove dead Bazel-only MSVC platforms, flags, and crate/toolchain rewrites
• sanitize the Windows Bazel client and repository environments before server startup
• audit declared action tools, frozen build/test paths, gnullvm coverage, native/V8 builds, and the protected C probe
• run the fixed audit in the Windows Bazel clippy lane

Parent: #29162

Validation

• focused Windows-gnullvm cross-build of aws-lc-sys, ring, zstd, and the stack-protector probe
• representative native, V8, and lint aquery graphs passed the hermeticity audit