[v1.0.0 Feature] introduce safe warm workers

[MarcusSorealheis]

Description

Implements Copy-on-Write (COW) isolation for warm worker pools to prevent cross-tenant state contamination in multi-tenant RBE deployments.

Fixes #2049

Type of change

• New feature (non-breaking change which adds functionality)
• This change requires a documentation update

How Has This Been Tested?

Locally. Needs to be tested by the community.

Checklist

• Updated documentation if needed
• Tests added/amended
• bazel test //... passes locally
• PR is contained in a single commit, using git amend see some docs

---

This change is 

[MarcusSorealheis]

If you'd like to preview the docs, you may need to install some prerequisites on your machine. Then you can execute the following commands:

cd web/platform
bun setup
bun docs
rm -r dist && bun run build
bun preview

[MarcusSorealheis]

@palfrey if you can ascertain why these tests have been so flakey (all musl-related), that would be greatly appreciated.

Create OCI image / Publish image (pull_request)
Create OCI image / Publish image (pull_request)Cancelled after 30m
Create OCI image / Publish nativelink-worker-init (pull_request)
Create OCI image / Publish nativelink-worker-init (pull_request)Cancelled after 30m
Nix / rbe-toolchain (pull_request)
Nix / rbe-toolchain (pull_request)Cancelled after 45m