bazel-hermetic: preserve bazelisk/token env; robust id -un fallback

Two findings from the latest Gemini pass:

- Preserve BAZELISK_HOME, BAZELISK_BASE_URL, BAZELISK_GITHUB_TOKEN and
  GITHUB_TOKEN through the pruned env. These are cache-location / mirror /
  auth configuration (same class as the proxy and TLS vars already
  passed), and they matter when the resolved bazel is a bazelisk wrapper
  used directly via the fallback path: a custom cache dir, an enterprise
  mirror, or GitHub rate-limit tokens would otherwise be lost.

- USER/LOGNAME fall back to `id -un 2>/dev/null || echo nobody`. In a
  minimal container running under an arbitrary UID with no /etc/passwd
  entry, `id -un` fails; under set -e the bare `$(id -un)` aborted the
  exec. Verified with a stubbed failing id: the script now completes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Øyvind Harboe <oyvind.harboe@zylin.com>

Author: oharboe

etc/bazel-hermetic

@@ -178,11 +178,14 @@ esac
 
 # Network, auth, TLS and cache/tmp configuration is not toolchain leakage:
 # downloads must work behind corporate proxies, custom CAs, and git-over-ssh
-# overrides, and users may relocate caches and tmp.
+# overrides, and users may relocate caches and tmp. The BAZELISK_* / token
+# vars matter when the resolved bazel is a bazelisk wrapper used directly
+# (custom cache location, enterprise mirror, GitHub rate limits).
 preserved_env=()
 for var in http_proxy https_proxy no_proxy HTTP_PROXY HTTPS_PROXY NO_PROXY \
   SSH_AUTH_SOCK SSL_CERT_FILE SSL_CERT_DIR XDG_CACHE_HOME TMPDIR \
-  DISPLAY WAYLAND_DISPLAY XAUTHORITY; do
+  DISPLAY WAYLAND_DISPLAY XAUTHORITY \
+  BAZELISK_HOME BAZELISK_BASE_URL BAZELISK_GITHUB_TOKEN GITHUB_TOKEN; do
   # Pure-bash lookup via eval: no subprocess (vs printenv, which also
   # silently drops everything if it isn't on PATH), and no ${!var}/-v,
   # which are unreliable on the bash 3.2 macOS ships. The names come from
@@ -222,8 +225,8 @@ esac
 # an empty HOME; the array guards give the set -u / bash 3.2 safety.
 exec env -i \
   HOME="${HOME:?etc/bazel-hermetic: HOME must be set}" \
-  USER="${USER:-$(id -un)}" \
-  LOGNAME="${LOGNAME:-$(id -un)}" \
+  USER="${USER:-$(id -un 2>/dev/null || echo nobody)}" \
+  LOGNAME="${LOGNAME:-$(id -un 2>/dev/null || echo nobody)}" \
   TERM="${TERM:-dumb}" \
   LANG="${lang}" \
   PATH="${TOOLBOX}" \