bundle: export standalone AOT runtime sources for Bazel links

[dank-openai]

This change makes the XLS runtime bundle expose the producer-published standalone AOT runtime source target when the selected XLS release includes it. Bazel consumers can depend on @<name>_runtime//:xls_aot_runtime_source_dep while older release lanes that do not carry the optional source asset still materialize normally.

Problem Solved

The runtime bundle currently exports the flattened standalone archive for downstream native links. That archive is still useful for direct consumers, but a mixed Bazel final link needs a declared source dependency so Bazel owns the native link closure instead of importing a flattened archive with bundled native dependencies.

Minimized example:

selected XLS release has source asset
  @default_xls_runtime//:xls_aot_runtime_source_dep
    -> aliases the producer source target

older XLS release has no source asset
  runtime bundle still loads
  no source dependency is exported

What Changed

• Download and materialize xls-aot-runtime-source.tar.gz beside the selected XLS runtime payload when it exists.
• Unpack that producer-owned source repo into the generated runtime repository and export a public :xls_aot_runtime_source_dep alias.
• Add local-source override plumbing for review and staged rollout proofs.
• Keep the source payload optional so old and frozen lanes without the asset do not stop non-AOT consumers from loading the bundle.

Validation

• bazel test //:artifact_resolution_test //:download_release_test //:external_bundle_exports_test