fix(bazel): make ci validation suite remote-hermetic

[Jesssullivan]

Summary

• add a Bazel-generated src/lib/tsconfig.json shim for Vitest/OXC under //:unit_tests
• make the SvelteKit/Vite smoke use package bins resolved from the copied build root
• make the copied build root writable before svelte-kit sync and vite build

Why

TIN-2288 GF REAPI warm proof reached forced remote execution but exposed tinyland-goo hermeticity failures in //:ci_validation_suite:

• Vitest/OXC could not find a tsconfig from the transformed bin-tree test path
• the SvelteKit/Vite smoke needed a writable copied workspace and package-bin resolution from that workspace

Validation

• git diff --check
• nix develop --command just check
• GF_BAZEL_SUBSTRATE_MODE=shared-cache-backed BAZEL_REMOTE_CACHE=grpc://bazel-cache-grpc:9092 GF_BAZEL_REMOTE_UPLOAD=false just flywheel-test //:ci_validation_suite

Note: the local Flywheel wrapper run still observed the known RustFS NoSuchBucket remote-cache warning, but Bazel continued and all three tests passed. That remains TIN-1147 backend-authority debt, not this hermeticity fix.