fix(toolchains): mark the python extension os- and arch-dependent (#4259)

The `python` extension picks `*_host` runtimes by checking
`module_ctx.os`,
but doesn't declare that it depends on the host. Bazel caches the result
in
the output base under a single key, so an output base shared by amd64
and
arm64 (e.g. a Docker cache volume) reuses the other host's result and
fails:

```
Could not find a compatible 'host' python for 'linux', 'aarch64'
from the loaded platforms: ["x86_64-unknown-linux-gnu", ...]
```

Setting `os_dependent` and `arch_dependent` makes Bazel evaluate the
extension per host.

Reproduced with Bazel 8.8.1 and 9.1.1 by running amd64 then arm64
containers
on one output base; this change fixes it. Bazel 7.7.1 is unaffected. No
test,
since it needs two hosts sharing an output base.

news/python-ext-os-arch-dependent.fixed.md

diff --git a/news/python-ext-os-arch-dependent.fixed.md b/news/python-ext-os-arch-dependent.fixed.md
new file mode 100644
index 0000000..ea17098
--- /dev/null
+++ b/news/python-ext-os-arch-dependent.fixed.md
@@ -0,0 +1,3 @@
+(toolchains) The `python` extension is re-evaluated when the host OS or CPU
+changes, so an output base shared between hosts no longer fails to fetch the
+`*_host` interpreter repo.

python/private/python.bzl

diff --git a/python/private/python.bzl b/python/private/python.bzl
index 05334c3..19db885 100644
--- a/python/private/python.bzl
+++ b/python/private/python.bzl
@@ -1624,6 +1624,8 @@
         "toolchain": _toolchain,
     },
     environ = ["RULES_PYTHON_BZLMOD_DEBUG"],
+    os_dependent = True,
+    arch_dependent = True,
 )
 
 _DEBUG_BUILD_CONTENT = """