Add feature-matrix toolchain configuration

[helly25]

Feature-matrix toolchain configuration

Allow per feature-matrix llvm config overrides.

AG;DR

The primary change is a generic feature matrix for one logical LLVM toolchain, not a linker-specific switch. Keep the existing configuration as the default/fallback and describe complete conditional variants with llvm.feature_override(...) in Bzlmod or llvm_feature_override(...) in WORKSPACE.

• Match arbitrary enabled and disabled build features using one Bazel-style signed list, for example features = ["thin_lto", "-msan"]. A negative entry matches an absent or disabled feature; contradictory entries are rejected. Optionally restrict matches to target platforms. Only the specified features participate; unrelated features are ignored.
• Override any public toolchain setting: LLVM distributions, linker selection, sysroots, flags, libraries, compatibility constraints and sandbox inputs.
• Inherit unspecified settings. Dictionaries merge by key; supplied values replace inherited values. reset clears inherited attributes or restores schema defaults. Scalar/plural version settings supersede their inherited counterpart.
• Select the fallback when nothing matches; fail explicitly when multiple variants match. There is no implicit ordering or stacking.
• Register all variants through the existing toolchain repository/name, keeping compiler, linker and sandbox inputs consistent. Reuse the base LLVM archive when distribution settings are unchanged.

For example, use downloaded mold by default but select bundled LLD for Bazel ThinLTO:

llvm.toolchain(
    name = "llvm_toolchain",
    llvm_version = "23.1.2",
    linker = {"linux-x86_64": "mold", "darwin-aarch64": "auto"},
    linker_version = "latest",
)
llvm.feature_override(
    name = "llvm_toolchain",
    features = ["thin_lto"],
    linker = {"linux-x86_64": ""},
)

Selection uses configuration-level --features, and --host_features for execution tools. It does not inspect rule-local features, implied C++ features, or raw compiler flags such as -flto=thin. These boundaries are documented and tested.

Coverage and supporting changes

• Unit tests cover arbitrary/conjunctive/negative predicates, disabled features, target filters, ambiguity, inheritance, resets, validation and archive reuse (including resetting an external LLVM root).
• Integration fixtures exercise fallback, changed language standards/flags/sandbox inputs, actual LLVM 23-to-22 distribution switching, mold-to-LLD ThinLTO and independent host-feature selection. CI covers macOS/Linux, Bazel 9 Bzlmod, Bazel 8 WORKSPACE and Bazel 7 Bzlmod.
• Strengthen the Linux MSan tests with compile-time instrumentation guards and a separate C test that must emit MemorySanitizer: use-of-uninitialized-value and exit with the expected status. An ordinary failure or crash cannot pass.
• Briefly document unsupported MSan errors, ASan+UBSan compatibility, and mold LTO's need for a compatible LLVMgold.so, which the standalone mold archive does not contain.
• Install the ICU 70 runtime required by LLVM 23's Linux LLD in the Ubuntu CI setup. Modestly increase Bazel connector attempts to 10 and timeout scaling to 1.5, leaving whole-download retry/backoff defaults unchanged.

Validation

• Bazel 9 root suite: 20 tests passed; Bazel 8 WORKSPACE feature unit suite: 14 passed, including signed predicates, negative-only matches, explicit disablement, duplicate conditions, malformed entries and contradictions in either order.
• Full feature-matrix integration script passed locally on macOS with Bazel 9/Bzlmod and Bazel 8/WORKSPACE, repeated after the signed-feature API change. This includes disabling an explicitly enabled excluded feature, distribution switching, fallback and independent host selection. Bazel 7 feature selection also compiled and passed before the syntax refinement.
• Linux/amd64 container: downloaded mold, matching override/fallback, rule-local feature isolation, host-feature selection and ThinLTO with bundled LLD all passed. The already checksum-verified LLVM archive was reused for the final Linux checks.
• Unsupported macOS MSan regression passed with Bazel 9 and LLVM 23.
• Both Linux MSan binaries compile instrumented and reject uninstrumented builds. Native Linux CI now verifies both runtime tests: msan_libcxx_test and the diagnostic-required msan_detection_test passed on Bazel 7, 8, 9 and latest. All feature-matrix jobs and the required-checks gate also passed in CI run 36681030848, for head 6b40c5a25b54a44c10ce3c8977df64b14cc8de15. The earlier local QEMU memory limitation is no longer a verification blocker.
• After the signed-feature API change, Linux/amd64 container checks passed for both the C++20/flags/sandbox-input override and mold-to-LLD ThinLTO selection.
• Repository lint and git diff --check passed. Signed-feature head 9c9b069 completed all 93 CI checks successfully before rebasing.

Rebase verification

Rebased onto master after #875 merged (a699ee9). git range-diff confirms both feature-matrix commits are unchanged. Current head: 7bf9147.

• Bazel 9.0.0 root suite: 20/20 tests passed, all executed with --nocache_test_results.
• Full macOS feature-selection integration script passed with Bazel 9.0.0/Bzlmod and Bazel 8.6.0/WORKSPACE, including fallback, signed predicates, LLVM distribution switching, rule-local feature isolation and independent host-feature selection.
• Fresh CI: Tests run 36804190226. Protected squash auto-merge is enabled; merging remains gated on the required checks.