Make Zig actions hermetic and remote-execution safe

[darthfork]

Current rules write Zig caches to /tmp/zig-cache and /tmp/zig-global-cache, which is not hermetic and will cause trouble with sandboxing, remote execution, and shared builders.

Current code:

• zig/rules.bzl

Tasks:

• Stop writing caches to hardcoded global temp directories.
• Use action-local writable paths derived from declared outputs or action environment.
• Verify builds work under sandboxing.
• Verify repeated builds do not leak state across targets.
• Verify behavior under remote cache / remote execution assumptions.

Acceptance criteria:

• No hardcoded /tmp cache paths remain in rule implementations.
• bazel build //... works with sandboxing enabled.
• Rule behavior is deterministic across clean and incremental builds.

Parent issue: #2

[darthfork]

Closing as completed by PR #22. The rule implementations now declare Zig cache/global-cache directories as Bazel action outputs instead of writing to hardcoded /tmp paths, and CI validates bazel test //....