Add gleam_host convenience repository; complete Phase 4

[aaylward]

Summary

• Resolves the gleam_host TODO in gleam_register_toolchains: a new <name>_host repository (gleam/private/host_repo.bzl) detects the host OS/arch and re-exposes the matching per-platform toolchain repo, so the gleam CLI can be run directly without knowing the host's platform string: bazel run @gleam_host//:gleam -- format.
• Fixes a visibility gap in _gleam_repo_impl's generated BUILD.bazel (missing default_visibility, unlike hermetic_erlang_repository.bzl) that would otherwise make the per-platform repos' raw gleam/gleam.exe file targets unreachable from gleam_host's alias.
• Adds test/unit/host_repo/ unit tests (bazel-skylib unittest/analysistest) covering host platform resolution (Linux/macOS/Windows, the arm64/amd64 alternate arch spelling, and failure on unsupported OS/arch). CI on a real macOS (Apple Silicon) runner caught a genuine bug this test was built to catch: arm64 was being mapped to itself instead of normalized to PLATFORMS' aarch64 spelling — fixed.
• Wires gleam_host into the root MODULE.bazel's use_repo(...) and adds a CI step that runs bazel run @gleam_host//:gleam -- --version and checks its output.
• Documents the new repository in gleam/extensions.bzl's module docstring and README.md.

Phase 4 (stretch items), also included in this PR:

• Pins real, CI-observed sha256 checksums for the hermetic Erlang/OTP toolchain: the built-in default (OTP-28.1, linux_amd64 + macos_arm64) and examples/hermetic_erlang's explicit pin (OTP-29.0.2, same two platforms). Platforms CI doesn't exercise (linux_arm64, macos_amd64) remain unpinned until observed on a real run, consistent with the existing convention.
• Adds a CI step that builds examples/smoke's //:my_app twice (with a bazel clean in between to force real re-execution rather than a cache hit) and diffs the two escripts byte-for-byte, to catch nondeterminism in gleam_binary's output. This check found two real, previously-undetected reproducibility bugs, both fixed here:
  • escript_builder.erl's zip archive stamped each entry with the current wall-clock time (not anything about the input files) when no explicit file_info() was given, so two builds even a few seconds apart produced different bytes. Fixed by pinning a fixed timestamp for every entry, and sorting file:list_dir/1's output (also unordered) before archiving.
  • Every compiled .beam file embedded the compiling machine's absolute sandbox path (via Gleam's own codegen -file(...) attributes, encoded into the "Line" chunk that beam_lib:strip/1 does not remove) — since Bazel runs each action in a fresh sandbox directory, this path differs between two builds of the same target. Fixed at the source instead of scrubbing it after the fact: erlc's +deterministic compile option (and, for gleam compile-package's internal erlc calls, the equivalent ERL_COMPILER_OPTIONS=[deterministic] env var) stops the embedding entirely. Applied to every erlc/gleam compile-package invocation in gleam_library.bzl, gleam_binary.bzl, and gleam_test.bzl.
• Adds ARCHITECTURE.md documenting the repo's layout and its four-layer test taxonomy (Starlark unit tests, gleam_gazelle's Go tests/golden files, example projects, CI-only verification steps), linked from README.md and CONTRIBUTING.md.

Test plan

• buildifier -mode=diff/-lint=warn clean on all changed .bzl/BUILD.bazel/MODULE.bazel files (buildifier built locally via go install since Bazel itself is unavailable in this environment)
• Relevant pre-commit hooks pass (check-yaml, yamlfmt, end-of-file-fixer, trailing-whitespace, prettier, typos)
• Both reproducibility bugs verified end-to-end locally with a standalone erl/erlc reproduction (outside Bazel) before pushing each fix, confirming the old code differs and the fixed code doesn't
• CI green on both Linux and macOS: bazel test //test/... (new host_repo_test_suite), the new @gleam_host//:gleam runnability check, and the new determinism check
• Real checksums for the hermetic Erlang/OTP pins were taken directly from CI's own printed NOTE: log lines, not guessed