treewide: remove FHSEnv

To remove the FHSenv, we have to patch rules_python to use
/usr/bin/env to resolve the path to bash instead of hardcoding it.
Additionally, we now bring a Nix-compatible Bazel 8.

Change-Id: Id51e7748eea6dd77185f43a52fe45b5110ba4a2b
Reviewed-on: https://review.monogon.dev/c/monogon/+/4427
Tested-by: Jenkins CI
Reviewed-by: Jan Schär <jan@monogon.tech>
Reviewed-by: Lorenz Brun <lorenz@monogon.tech>
Reviewed-by: Leopold Schabel <leo@monogon.tech>
diff --git a/build/toolchain/toolchain-bundle/BUILD.bazel b/build/toolchain/toolchain-bundle/BUILD.bazel
index 82437da..66de9f5 100644
--- a/build/toolchain/toolchain-bundle/BUILD.bazel
+++ b/build/toolchain/toolchain-bundle/BUILD.bazel
@@ -1,4 +1,7 @@
 load("@rules_perl//perl:toolchain.bzl", "perl_toolchain")
+load("@rules_python//python:py_exec_tools_toolchain.bzl", "py_exec_tools_toolchain")
+load("@rules_python//python:py_runtime.bzl", "py_runtime")
+load("@rules_python//python:py_runtime_pair.bzl", "py_runtime_pair")
 load(":toolchain.bzl", "SUPPORTED_TARGETS", "TOOLCHAINS", "toolchain_for")
 
 package(default_visibility = ["//visibility:public"])
@@ -11,6 +14,42 @@
     for name, config in TOOLCHAINS.items()
 ]
 
+[
+    [
+        py_runtime(
+            name = "rules_python_%s_python3_12_runtime" % target.tuple,
+            interpreter = "@toolchain-bundle-%s//:python3.12" % target.triple,
+            interpreter_version_info = {
+                "major": str(3),
+                "minor": str(12),
+                "micro": str(0),
+            },
+            python_version = "PY3",
+        ),
+        py_runtime_pair(
+            name = "rules_python_%s_python3_12_runtime_pair" % target.tuple,
+            py3_runtime = ":rules_python_%s_python3_12_runtime" % target.tuple,
+        ),
+        py_exec_tools_toolchain(
+            name = "rules_python_%s_python3_12_exec_tools_toolchain_impl" % target.tuple,
+            exec_interpreter = ":rules_python_%s_python3_12_runtime_pair" % target.tuple,
+        ),
+        toolchain(
+            name = "rules_python_%s_python3_12_runtime_toolchain" % target.tuple,
+            exec_compatible_with = target.constrain,
+            toolchain = ":rules_python_%s_python3_12_runtime_pair" % target.tuple,
+            toolchain_type = "@rules_python//python:toolchain_type",
+        ),
+        toolchain(
+            name = "rules_python_%s_python3_12_exec_tools_toolchain" % target.tuple,
+            exec_compatible_with = target.constrain,
+            toolchain = ":rules_python_%s_python3_12_exec_tools_toolchain_impl" % target.tuple,
+            toolchain_type = "@rules_python//python:exec_tools_toolchain_type",
+        ),
+    ]
+    for target in SUPPORTED_TARGETS
+]
+
 # rules_perl wiring
 
 [
diff --git a/build/toolchain/toolchain-bundle/toolchain-bundle.bzl b/build/toolchain/toolchain-bundle/toolchain-bundle.bzl
index 6ac17fb..c2de9d1 100644
--- a/build/toolchain/toolchain-bundle/toolchain-bundle.bzl
+++ b/build/toolchain/toolchain-bundle/toolchain-bundle.bzl
@@ -4,6 +4,32 @@
     "**/*",
 ]))
 
+filegroup(
+    name = "python3.12",
+    srcs = [
+        ":bin/python3.12",
+    ],
+    data = glob([
+        "lib/python3.12/**",
+    ]),
+)
+
+filegroup(
+    name = "python3.12_headers",
+    srcs = glob([
+        "include/python3.12/**",
+    ]),
+)
+
+filegroup(
+    name = "python3.12_libs",
+    srcs = glob([
+        "lib/python3.12/**",
+    ]) + [
+        ":lib/libpython3.12.a",
+    ],
+)
+
 # rules_perl expects all files as src entry, this does prevent us using
 # $(execpath) which is why we have another filegroup that uses this as
 # data dep.