fix(interpreter): propagate python version flags through exec transitions

e2e/MODULE.bazel

@@ -531,6 +531,33 @@ uv.project(
 )
 # }}}
 
+# For cases/uv-exec-marker-build-dep
+# Regression: marker-gated transitive deps of sdist build tools (e.g.
+# setuptools-scm -> vcs-versioning -> typing-extensions under
+# `python_full_version < '3.11'`) must stay in the build_tool venv when the
+# tool is analyzed in the exec configuration.
+# {{{
+uv.declare_hub(hub_name = "pypi-exec-marker")
+uv.project(
+    default_build_dependencies = [
+        "build",
+        "setuptools",
+        "setuptools-scm",
+        "wheel",
+    ],
+    hub_name = "pypi-exec-marker",
+    lock = "//cases/uv-exec-marker-build-dep:uv.lock",
+    pyproject = "//cases/uv-exec-marker-build-dep:pyproject.toml",
+)
+uv.override_package(
+    name = "docopt",
+    lock = "//cases/uv-exec-marker-build-dep:uv.lock",
+    pre_build_patch_strip = 1,
+    pre_build_patches = ["//cases/uv-exec-marker-build-dep/patches:import_typing_extensions.patch"],
+)
+use_repo(uv, "pypi-exec-marker")
+# }}}
+
 # For cases/uv-group-multi-version
 # Regression: the same package locked at multiple marker-gated versions
 # within a single dependency group must resolve per-platform instead of

e2e/cases/uv-exec-marker-build-dep/BUILD.bazel

@@ -0,0 +1,30 @@
+# Regression test: PEP 508 markers gating transitive deps of the sdist
+# build_tool venv must be evaluated against the python version selected for
+# the target, even though the build_tool is analyzed in the exec
+# configuration.
+#
+# The chain mirrors the numcodecs/setuptools-scm field failure: docopt is
+# built from its sdist; setuptools-scm sits in the build_tool venv and its
+# setuptools entry point import chain (setuptools_scm -> vcs-versioning)
+# needs typing-extensions under `python_full_version < '3.11'`. The docopt
+# sdist is pre-build-patched (see MODULE.bazel override) to perform that
+# import unconditionally, standing in for the entry points setuptools loads
+# from every installed dist during `python -m build`.
+#
+# Under --incompatible_exclude_starlark_flags_from_exec_config (default in
+# Bazel 10) the Starlark python version flags used to be reset to their
+# defaults by the exec transition: the marker env decided 3.11, dropped
+# typing-extensions/tomli to :empty, and the build failed with
+# ModuleNotFoundError. Fixed by scope = "universal" on
+# @aspect_rules_py//py/private/interpreter:python_version.
+
+load("@aspect_rules_py//py/unstable:defs.bzl", "py_venv_test")
+
+py_venv_test(
+    name = "test",
+    srcs = ["__test__.py"],
+    main = "__test__.py",
+    python_version = "3.10",
+    venv = "uv-exec-marker-build-dep",
+    deps = ["@pypi-exec-marker//docopt"],
+)

e2e/cases/uv-exec-marker-build-dep/__test__.py

@@ -0,0 +1,7 @@
+import sys
+
+import docopt
+
+assert sys.version_info[:2] == (3, 10), sys.version_info
+assert docopt.__doc__ is not None
+print("ok")

e2e/cases/uv-exec-marker-build-dep/patches/BUILD.bazel

@@ -0,0 +1,3 @@
+exports_files([
+    "import_typing_extensions.patch",
+])

e2e/cases/uv-exec-marker-build-dep/patches/import_typing_extensions.patch

@@ -0,0 +1,13 @@
+--- a/setup.py
++++ b/setup.py
+@@ -1,4 +1,10 @@
+ from setuptools import setup
+
++# Models the numcodecs field failure: setuptools loads the entry points of
++# every dist installed in the build venv (setuptools-scm -> vcs-versioning),
++# whose import chain needs the marker-gated typing-extensions on the
++# interpreter the build tool actually runs.
++from typing_extensions import Self as _Self  # noqa: F401
++
+ from docopt import __version__
+

e2e/cases/uv-exec-marker-build-dep/pyproject.toml

@@ -0,0 +1,11 @@
+[project]
+name = "uv-exec-marker-build-dep"
+version = "0.0.0"
+requires-python = ">=3.10"
+dependencies = [
+    "docopt",
+    "build",
+    "setuptools",
+    "setuptools-scm",
+    "wheel",
+]

py/private/interpreter/BUILD.bazel

@@ -10,6 +10,15 @@ exports_files(["probe_interpreter.py"])
 string_flag(
     name = "python_version",
     build_setting_default = "",
+    # "universal" causes this flag to propagate through exec transitions so
+    # that tools built in exec configuration (e.g. sdist build_tool venvs and
+    # the PEP 508 marker environment derived from this flag) keep the python
+    # version selected for the target instead of falling back to the flag
+    # default. Required when
+    # --incompatible_exclude_starlark_flags_from_exec_config is active (will
+    # be default in Bazel 10; bazelbuild/bazel#26909). Same rationale as
+    # //uv/private/constraints/venv:venv (PR #917).
+    scope = "universal",
 )
 
 # Interpreter feature exclusions. Pass one or more --exclude_feature flags to
@@ -39,6 +48,10 @@ exclude_feature_flag(
 bool_flag(
     name = "freethreaded",
     build_setting_default = False,
+    # Propagated by the python_transition alongside :python_version and
+    # consumed by interpreter toolchain target_settings; must survive exec
+    # transitions for the same reason as :python_version above.
+    scope = "universal",
 )
 
 bool_flag(