Optimize _create_zip_file with C++ wrapper to reduce analysis-phase memory

Context:
The _create_zip_file function in py_executable.bzl was causing significant
memory and CPU usage during Bazel's analysis phase when building at scale.
The root cause was calling to_list() on runfiles depsets containing thousands
of files, forcing O(N) memory allocation during analysis.

Intent:
Replace Starlark depset materialization with a lightweight C++ wrapper that
processes file lists at execution time. This achieves O(1) analysis-phase
memory while maintaining native execution performance.

Changes:
- Add py_executable_zip_gen.cc: C++ tool using std::filesystem for path
  manipulation and Bazel's runfiles library to locate zipper
- Update BUILD.bazel: Replace sh_binary with cc_binary for py_executable_zip_gen
- Update py_executable.bzl: Simplify _create_zip_file to use wrapper's API,
  eliminate to_list() calls, pass runfiles_without_exe to avoid filtering
- Update py_repositories.bzl: Add dependency on rules_shell

Performance Impact:
- Analysis phase: O(N) → O(1) memory (primary goal achieved)
- Execution phase: +0.1% overhead (within measurement noise)
- One-time cost: 1-2s C++ compilation per workspace
- Build artifacts: Byte-for-byte identical to main branch (same SHA256)

Testing:
- Verified identical build artifacts via SHA256 hash comparison
- Benchmarked incremental builds: 9.869s (main) vs 9.879s (C++ wrapper)
- Tested with py_binary and py_test targets
- Confirmed std::filesystem works with default Bazel C++ toolchain

Author: tobyh-canva

python/private/BUILD.bazel

@@ -829,6 +829,16 @@ py_binary(
     ],
 )
 
+# Used for py_executable rule
+# C++ wrapper for zipper to process Python zip manifests
+cc_binary(
+    name = "py_executable_zip_gen",
+    srcs = ["py_executable_zip_gen.cc"],
+    data = ["@bazel_tools//tools/zip:zipper"],
+    deps = ["@bazel_tools//tools/cpp/runfiles"],
+    visibility = ["//visibility:public"],
+)
+
 py_binary(
     name = "py_wheel_dist",
     srcs = ["py_wheel_dist.py"],

python/private/py_executable.bzl

@@ -236,7 +236,7 @@ accepting arbitrary Python versions.
         "_zipper": lambda: attrb.Label(
             cfg = "exec",
             executable = True,
-            default = "@bazel_tools//tools/zip:zipper",
+            default = ":py_executable_zip_gen",
         ),
     },
 )
@@ -377,12 +377,12 @@ def _create_executable(
         )
 
     zip_file = ctx.actions.declare_file(base_executable_name + ".zip", sibling = executable)
+
     _create_zip_file(
         ctx,
         output = zip_file,
-        original_nonzip_executable = executable,
         zip_main = zip_main,
-        runfiles = runfiles_details.default_runfiles.merge(extra_runfiles),
+        runfiles = runfiles_details.runfiles_without_exe.merge(extra_runfiles),
     )
 
     extra_files_to_build = []
@@ -803,35 +803,23 @@ def _create_windows_exe_launcher(
         use_default_shell_env = True,
     )
 
-def _create_zip_file(ctx, *, output, original_nonzip_executable, zip_main, runfiles):
+
+def _create_zip_file(ctx, *, output, zip_main, runfiles):
     """Create a Python zipapp (zip with __main__.py entry point)."""
-    workspace_name = ctx.workspace_name
     legacy_external_runfiles = _py_builtins.get_legacy_external_runfiles(ctx)
 
-    manifest = ctx.actions.args()
-    manifest.use_param_file("@%s", use_always = True)
-    manifest.set_param_file_format("multiline")
-
-    manifest.add("__main__.py={}".format(zip_main.path))
-    manifest.add("__init__.py=")
-    manifest.add(
-        "{}=".format(
-            _get_zip_runfiles_path("__init__.py", workspace_name, legacy_external_runfiles),
-        ),
-    )
-    for path in runfiles.empty_filenames.to_list():
-        manifest.add("{}=".format(_get_zip_runfiles_path(path, workspace_name, legacy_external_runfiles)))
-
-    def map_zip_runfiles(file):
-        if file != original_nonzip_executable and file != output:
-            return "{}={}".format(
-                _get_zip_runfiles_path(file.short_path, workspace_name, legacy_external_runfiles),
-                file.path,
-            )
-        else:
-            return None
+    args = ctx.actions.args()
+    args.use_param_file("%s", use_always=True)
+    args.set_param_file_format("multiline")
 
-    manifest.add_all(runfiles.files, map_each = map_zip_runfiles, allow_closure = True)
+    args.add("--output")
+    args.add(output.path)
+    args.add("--workspace-name")
+    args.add(ctx.workspace_name)
+    args.add("--main-file")
+    args.add(zip_main.path)
+    if legacy_external_runfiles:
+        args.add("--legacy-external-runfiles")
 
     inputs = [zip_main]
     if _py_builtins.is_bzlmod_enabled(ctx):
@@ -844,43 +832,30 @@ def _create_zip_file(ctx, *, output, original_nonzip_executable, zip_main, runfi
             runfiles = runfiles,
             output = zip_repo_mapping_manifest,
         )
-        manifest.add("{}/_repo_mapping={}".format(
-            _ZIP_RUNFILES_DIRECTORY_NAME,
-            zip_repo_mapping_manifest.path,
-        ))
+        args.add("--repo-mapping-manifest")
+        args.add(zip_repo_mapping_manifest.path)
         inputs.append(zip_repo_mapping_manifest)
 
-    for artifact in runfiles.files.to_list():
-        # Don't include the original executable because it isn't used by the
-        # zip file, so no need to build it for the action.
-        # Don't include the zipfile itself because it's an output.
-        if artifact != original_nonzip_executable and artifact != output:
-            inputs.append(artifact)
-
-    zip_cli_args = ctx.actions.args()
-    zip_cli_args.add("cC")
-    zip_cli_args.add(output)
+    args.add_all(runfiles.empty_filenames, map_each=_get_zip_empty_path_arg)
+    args.add_all(runfiles.files, map_each=_get_zip_path_arg)
 
     ctx.actions.run(
         executable = ctx.executable._zipper,
-        arguments = [zip_cli_args, manifest],
-        inputs = depset(inputs),
+        arguments = [args],
+        inputs = depset(inputs, transitive=[runfiles.files]),
         outputs = [output],
         use_default_shell_env = True,
         mnemonic = "PythonZipper",
         progress_message = "Building Python zip: %{label}",
     )
 
-def _get_zip_runfiles_path(path, workspace_name, legacy_external_runfiles):
-    if legacy_external_runfiles and path.startswith(_EXTERNAL_PATH_PREFIX):
-        zip_runfiles_path = paths.relativize(path, _EXTERNAL_PATH_PREFIX)
-    else:
-        # NOTE: External runfiles (artifacts in other repos) will have a leading
-        # path component of "../" so that they refer outside the main workspace
-        # directory and into the runfiles root. By normalizing, we simplify e.g.
-        # "workspace/../foo/bar" to simply "foo/bar".
-        zip_runfiles_path = paths.normalize("{}/{}".format(workspace_name, path))
-    return "{}/{}".format(_ZIP_RUNFILES_DIRECTORY_NAME, zip_runfiles_path)
+
+def _get_zip_empty_path_arg(file):
+    return "{}=".format(file.short_path)
+
+
+def _get_zip_path_arg(file):
+    return "{}={}".format(file.short_path, file.path)
 
 def _create_executable_zip_file(
         ctx,