Expose sysroots as single directory artifacts

[Copilot]

Bazel 9 warns because each sysroot expands into ~5,600 inputs. A single source-directory artifact gives compile actions one sandbox symlink and one merkle-tree node.

• Layout: Extract Linux and macOS archives under sysroot/, prune :-named and .pl entries, and expose srcs = ["."] through the existing root :sysroot alias.
• Compatibility: Preserve :headers, :libs, and :toolchain_sysroot via subpackage forwarding. Keep archive selection and hashes unchanged.
• LLVM: Use direct package labels because LLVM derives its sysroot path from the configured label’s package:

  llvm.sysroot(
      name = "llvm_toolchain",
      label = "@sysroot_linux_amd64//sysroot:sysroot",
      targets = ["linux-x86_64"],
  )

• Migration and coverage: Document raw-label changes—//:usr/include/stdio.h becomes //sysroot:usr/include/stdio.h—including Envoy’s Rust SDK consumer. Add regression coverage for both Linux architectures and the empty macOS fallback.