Expose Bazel action starts to build proxies

[karim-alweheshy]

Summary

• request Bazel's pretty-printed subcommand lifecycle only for build-proxy invocations
• consume each action-start header immediately while suppressing the entire environment and command block from Xcode output
• publish only bounded allowlisted action identity fields to a private mode-0600 JSONL stream
• fail closed on malformed, nested, oversized, unterminated, linked, or pre-existing stream state and disable inherited subcommand output for metadata-only aquery

Stack

• Base: Report live Bazel progress to build proxies #3335
• Paired proxy slice: Present Bazel actions while they run karim-alweheshy/XCBBuildServiceProxyKit#19

Validation

• focused launcher and log-processor Bazel tests passed uncached with --ignore_all_rc_files
• direct Python suite: 5 tests, 0 failures
• bash -n, scoped ShellCheck, Buildifier, git diff --check, and TruffleHog passed
• real Bazel 9.2 reduced smoke observed the first start record while the wrapper remained alive; two sequential four-second actions produced two contiguous records at mode 0600 while command/environment bytes remained suppressed
• exact RedditApp project generation succeeded and embedded the paired release proxy and candidate adapter
• PID-bound Xcode 26.5 RedditApp build observed an individual link action in progress, then succeeded with real compile/link durations and no wrapper or errors

Testing

Generate a project with a build proxy, change a source file, and build from Xcode. Confirm the generated adapter contains the proxy-only start option, individual Bazel actions appear before completion, and the publishable build log contains neither the raw SUBCOMMAND: header nor its environment/command/runner block. Generate without a proxy and confirm the option and sidecar are absent.