refactor(build): hermetic install of files after build

.bazelrc

@@ -14,7 +14,7 @@ common --color=yes
 common --curses=auto
 
 build --experimental_ui_max_stdouterr_bytes=10485760
-# required to build shared library on macOS
+# TODO: remove after bump to bazel >= 7
 build --experimental_cc_shared_library
 
 build --show_progress_rate_limit=0

BUILD.bazel

@@ -123,6 +123,18 @@ config_setting(
     visibility = ["//visibility:public"],
 )
 
+config_setting(
+    name = "debug_linux_flag",
+    constraint_values = [
+        "@platforms//os:linux",
+    ],
+    flag_values = {
+        ":debug": "true",
+    },
+    visibility = ["//visibility:public"],
+)
+
+# --//:brotli=true
 bool_flag(
     name = "brotli",
     build_setting_default = True,
@@ -136,17 +148,6 @@ config_setting(
     visibility = ["//visibility:public"],
 )
 
-config_setting(
-    name = "debug_linux_flag",
-    constraint_values = [
-        "@platforms//os:linux",
-    ],
-    flag_values = {
-        ":debug": "true",
-    },
-    visibility = ["//visibility:public"],
-)
-
 # --//:licensing=false
 bool_flag(
     name = "licensing",
@@ -258,6 +259,20 @@ config_setting(
     visibility = ["//visibility:public"],
 )
 
+# --//:skip_tools=false
+bool_flag(
+    name = "skip_tools",
+    build_setting_default = False,
+)
+
+config_setting(
+    name = "skip_tools_flag",
+    flag_values = {
+        ":skip_tools": "true",
+    },
+    visibility = ["//visibility:public"],
+)
+
 ##### constraints, platforms and config_settings for cross-compile
 
 constraint_setting(name = "cross_build_setting")