feat(odin): add opt-in hermetic Linux linking

[clappingmonkey]

What does this PR do?

Odin downloads hermetically but links via a host-provided linker driver. This PR adds an opt-in mode that, on Linux x86_64/aarch64 only, points Odin's linker driver at a bring-your-own hermetic clang+lld and a pinned sysroot (ODIN_CLANG_PATH + -linker:lld + --sysroot/-B/-L), so the link uses zero host clang/ld/libc.

Design (verified against rules_go/rules_rust/toolchains_llvm best practice):

• Gated by the --@rules_odin//odin:hermetic_linker bool_flag (default false).
• Activated per target via the hermetic_clang / hermetic_toolchain_files / hermetic_sysroot attrs. A Linux target without hermetic_clang stays on the host linker even when the flag is set.
• Inert on macOS/Windows — Apple's macOS SDK and Microsoft's MSVC libraries are not redistributable, so those platforms always use the host toolchain (same posture as rules_go/rules_rust/zig-cc). A single flag across a multi-OS matrix is therefore ergonomic.
• Bring-your-own: rules_odin gains no new dependency; users wire toolchains_llvm + a sysroot themselves.
• Per-arch --target/--sysroot/-B/-L flags are computed in-ruleset from the target cpu constraint.
• Default (non-hermetic) behavior is completely unchanged.

How was it tested?

• Prior CI spike proved the Linux hermetic link green on ubuntu-24.04 (x86_64) and ubuntu-24.04-arm (aarch64), all Bazel versions — the binary linked and ran with zero host clang/ld/libc.
• New e2e/hermetic/ workspace (bring-your-own toolchains_llvm 1.8.0 + pinned Chromium sysroots) exercises the path; CI runs it Linux-only via a new gated step in check.yaml.
• Local (macOS): e2e/smoke, e2e/failure_propagation, and e2e/hermetic all pass — confirming the flag is inert on macOS (host path) and non-hermetic targets are unaffected.
• Reviewed by parallel code-quality + adversarial validators and a security audit; two blockers found and fixed, re-validated APPROVE.
• pre-commit run --all-files clean; bazel build //... clean.

Checklist

• PR title follows conventional commit format
• CI passes (check.yaml — lint + test matrix)
• Tests added or updated for new/changed behavior
• Documentation updated if user-facing (docstrings, README, CONTRIBUTING.md)
• No breaking changes (or BREAKING CHANGE section below is filled out)