Bazel `8.3.0` introduces `--repo_contents_cache` which _cannot_ be stored in the workspace.

The current version of our CI stores it in the workspace.

This needs to be resolved so we can put the content elsewhere.

Ensures that `semantic-release` gets a runner that respects `image`.

Brings hermetic Apple Silicon support.

Use the Cloudflare snapshot.

It will be disabled by default in Bazel 9.

Start that deprecation early.

Bazel warns when a transitive dependency has a newer version of a module
that is defined in the root module.

These are often noisy and not useful: we want Bazel to select the best
version based on the `compatibility_level`.

`@ape//:*` are deprecated.

Sebastian Birunt authored Jun 21, 2024 and Matthew Clarkson committed Jun 21, 2024

This brings runfile free binaries from the APE project.

It removes a dependency problem: core utilities are required to find Bash runfiles.

Prevents the targets being built under `bazelisk build //...`
which cannot work on all platforms. We want them to only be
built when toolchain resolution selects a target.

Prevents the targets being built under `bazelisk build //...`
which cannot work on all platforms. We want them to only be
built when toolchain resolution selects a target.

This prevents the aliases from being picked up in a `bazelisk build //...`
which _cannot_ complete because some of the aliases do not have valid
resolved toolchains for all platforms.

The `coreutils-*-linux-gnu` binaries have dynamic link to `glibc`.

Switching to the `musl` variants that are statically linked.

Leaving in the download targets for the `gnu` variants as we
_could_ register them with the `gnu` constraint from `toolchain_utils`
but there is not much point, because the `musl` variant will
always work.