Build Go servers with Bazel remote execution

[hugosantos]

Summary

• Add an opt-in Bazel Remote Execution API backend for Go server builds.
• Provision the tenant's Bazel cluster directly, including mTLS credentials and Remote Asset API access, without requiring a local bazelrc.
• Reuse uploaded workspaces, Go SDKs, action results, and CAS content across builds.
• Upload remote-built OCI layer blobs from RE workers while publishing image configs, manifests, and tags from the client.

Motivation

Go server builds currently repeat local compilation and image-layer work. Executing those operations through the shared Bazel cluster allows separate builds to reuse the same operations and CAS data.

Validation

• go test ./internal/sdk/host ./internal/sdk/golang ./internal/integrations/bazelremote ./internal/integrations/golang ./internal/artifacts/oci ./internal/cli/cmd/cluster
• go build -o /tmp/nsdev ./cmd/nsdev
• nsdev build global/server/iam --golang_use_bazel_remote
• Repeated the IAM build in a fresh process; the cached build completed in 13 seconds.