Investigate Bazel macOS SDK fetch 403 in experimental workflow

[dzianisv]

Summary

The experimental Bazel workflow is failing on main and PR branches on macOS because Bazel cannot download the Apple SDK package used by the LLVM toolchain setup.

Evidence

• failing main workflow: Bazel run 23563742925
• failing PR workflow example: Bazel run 23590629547, job 68694665008
• job log shows Bazel failing to download:
  • https://swcdn.apple.com/.../CLTools_macOSNMOS_SDK.pkg
  • error: GET returned 403 Forbidden

Impact

This is repository-wide CI breakage in the experimental Bazel macOS lane, not specific to PR #42.

[dzianisv]

Status update (2026-03-26):

I rechecked fork vs upstream. The exact macOS failure described here still reproduces on our fork, and it looks fork-specific rather than a general upstream breakage.

Current evidence:

• fork main Bazel run 23563742925 still fails
• PR example job 68694665008 still shows GET returned 403 Forbidden downloading CLTools_macOSNMOS_SDK.pkg from swcdn.apple.com
• that failing job is running on hosted macos-15-arm64 with the fork fallback workflow path (Local Bazel build on macos-15 for aarch64-apple-darwin)
• our .github/workflows/bazel.yml diverges from upstream and adds fork-only fallback logic (fallback_os: macos-15, reduced matrix)
• upstream main has recent successful Bazel runs, including 23606147606, and upstream uses macos-15-xlarge directly instead of this fallback path

Most likely fix: sync bazel.yml back toward upstream and remove/adjust the fork-only macOS fallback path rather than treating this as a code regression from PR #42.