feat(sdist): dynamic setup.py evaluator for build dep extraction

[arrdem]

Adds a dynamic setup.py evaluator to the sdist configure tool. Instead of trying to statically analyze setup.py via AST (which only covers a shrinking subset of simple cases), we exec() the file with a capturing setup() injected into module globals and a mock import system that prevents ImportError on missing packages.

This is inherently unsound — setup.py is arbitrary Python — but we're already running in Bazel's sandbox with a hermetic interpreter, so the blast radius is contained. The approach handles dynamic patterns (conditionals, function calls, file reads, platform checks) that real-world legacy packages actually use.

How it works

• _fake_setup(*args, **kwargs) captures all keyword args then raises _SetupCapture to abort execution
• _SetupCapture inherits from BaseException so except Exception: blocks in setup.py can't swallow it
• _MockModule provides a recursive mock object for any attribute access, preventing crashes from from mypackage import __version__ etc.
• _MockImportFinder intercepts imports via sys.meta_path, returning mock modules for anything not in stdlib
• setuptools.setup, distutils.core.setup, and bare setup in globals all route to the capturing function
• Interpreter state (sys.modules, sys.meta_path, sys.argv, sys.path, os.getcwd()) is fully restored in a finally block
• BaseException catch handles SystemExit from sys.exit() calls gracefully

Extracted setup_requires feed into build_requires and extra_deps. install_requires is reported in a new setup_py_install_requires field.

Also removes the noisy _log_build_dep_info print statements that spammed Bazel output during every sdist build.

Changes are visible to end-users: no

Test plan

• 37 tests total, all passing
• 11 new "rogues' gallery" tests covering real-world setup.py patterns
• 10 tests from initial commit covering literal lists, variable refs, list concat, dynamic runtime logic, etc.
• 16 pre-existing tests continue to pass

[aspect-workflows]

Bazel 8 (Test)

All tests were cache hits

106 tests (100.0%) were fully cached saving 47s.

---

Bazel 9 (Test)

All tests were cache hits

106 tests (100.0%) were fully cached saving 1m 18s.

---

Bazel 8 (Test)

e2e

All tests were cache hits

39 tests (100.0%) were fully cached saving 32s.

---

Bazel 9 (Test)

e2e

All tests were cache hits

39 tests (100.0%) were fully cached saving 29s.

---

Bazel 8 (Test)

examples/uv_pip_compile

All tests were cache hits

1 test (100.0%) was fully cached saving 444ms.