Bug: `_manifest_proto` output of Javac action is non-deterministic with multiplex worker sandboxing

[blainefreestone]

Description of the bug:

When building with --experimental_worker_multiplex_sandboxing (or --worker_sandboxing),
the _manifest_proto file produced by each java_library / java_binary compilation action
contains non-deterministic content. The file embeds the absolute sandbox slot path of each
compiled source file (e.g. __sandbox/751/_main/src/com/example/Foo.java), and the slot
number (751, 67, etc.) is allocated dynamically per-invocation and changes between builds.
This causes the manifest proto output to differ across otherwise identical builds.

The original code comment in AnnotationProcessingPlugin.java explicitly states that
FileObject#getName() should return exec-root-relative paths. This was true before
multiplex worker sandboxing was introduced. With sandboxing, the working directory for each
javac invocation is a numbered sandbox slot directory, so getName() now returns paths that
include the non-deterministic __sandbox/N/_main/ prefix.

Which category does this issue belong to?

Java Rules

What's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

Minimal java_library target:

# BUILD.bazel
java_library(
    name = "example",
    srcs = ["Example.java"],
)

// Example.java
package com.example;
public class Example {}

Build twice and compare:

bazel build //path/to:example
cp bazel-out/linux_amd64_gnu-fastbuild/bin/path/to/libexample.jar_manifest_proto /tmp/build1

bazel clean
bazel build //path/to:example

diff /tmp/build1 bazel-out/linux_amd64_gnu-fastbuild/bin/path/to/libexample.jar_manifest_proto

The diff shows only the slot number changing:

-  __sandbox/751/_main/src/com/example/Example.java
+  __sandbox/67/_main/src/com/example/Example.java

Requires --worker_sandboxing or --experimental_worker_multiplex_sandboxing to reproduce.

Which operating system are you running Bazel on?

No response

What is the output of bazel info release?

release 8.6.0

If bazel info release returns development version or (@non-git), tell us how you built Bazel.

No response

What's the output of git remote get-url origin; git rev-parse HEAD ?

If this is a regression, please try to identify the Bazel commit where the bug was introduced with bazelisk --bisect.

No response

Have you found anything relevant by searching the web?

No response

Any other information, logs, or outputs that you want to share?

Proposed fix

Pass workDir to AnnotationProcessingModule and use it in stripSourceRoot() to
relativize source paths, mirroring the existing logic in FormattedDiagnostic.

[blainefreestone]

PR to fix: #29469