bazel-hermetic: preserve cloud credential env for remote cache auth

Gemini: env -i strips the credentials bazel needs to authenticate to
cloud remote-cache / remote-execution backends (GCS, S3), so a build
that relies on the remote cache would fail to authenticate. Preserve
GOOGLE_APPLICATION_CREDENTIALS and the common AWS_* variables alongside
the proxy/TLS/bazelisk config already passed through — same rationale:
auth/cache configuration is not toolchain leakage.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Øyvind Harboe <oyvind.harboe@zylin.com>

Author: oharboe

etc/bazel-hermetic

@@ -182,12 +182,18 @@ esac
 # downloads must work behind corporate proxies, custom CAs, and git-over-ssh
 # overrides, and users may relocate caches and tmp. The BAZELISK_* / token
 # vars matter when the resolved bazel is a bazelisk wrapper used directly
-# (custom cache location, enterprise mirror, GitHub rate limits).
+# (custom cache location, enterprise mirror, GitHub rate limits). The cloud
+# credential vars keep remote cache/execution auth (GCS, S3) working under
+# env -i.
 preserved_env=()
 for var in http_proxy https_proxy no_proxy HTTP_PROXY HTTPS_PROXY NO_PROXY \
   SSH_AUTH_SOCK SSL_CERT_FILE SSL_CERT_DIR XDG_CACHE_HOME TMPDIR \
   DISPLAY WAYLAND_DISPLAY XAUTHORITY \
-  BAZELISK_HOME BAZELISK_BASE_URL BAZELISK_GITHUB_TOKEN GITHUB_TOKEN; do
+  BAZELISK_HOME BAZELISK_BASE_URL BAZELISK_GITHUB_TOKEN GITHUB_TOKEN \
+  GOOGLE_APPLICATION_CREDENTIALS \
+  AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN \
+  AWS_ROLE_ARN AWS_WEB_IDENTITY_TOKEN_FILE AWS_SHARED_CREDENTIALS_FILE \
+  AWS_PROFILE AWS_CONFIG_FILE AWS_DEFAULT_REGION AWS_REGION; do
   # Pure-bash indirect lookup, no subprocess and no eval: ${!var+x} tests
   # whether the variable named by $var is set (set -u-safe), then ${!var}
   # reads its value.