[aignas]

refactor(toolchain): select bundled coverage wheels with select_whl

Before this change the coverage wheels bundled with the hermetic toolchain
were stored as a nested dict keyed by the python ABI and the toolchain
platform, and the platform filtering was done in the Python update script.

Now the update script stores all of the wheels as a flat list using a
format similar to uv.lock - struct(url = ..., hash = "sha256:...") - and
the Starlark side uses select_whl to pick the wheel that is compatible with
the python version and the toolchain platform. The update script no longer
does any filtering, but it accepts multiple coverage versions, each with an
optional PEP 508 marker for when it should be used, because newer coverage
releases drop support for older python versions, e.g.:

bazel run //dev/update_deps:update_coverage_deps -- \
    "7.10.7; python_full_version < '3.15'" \
    "7.17.0; python_full_version >= '3.15'"

The marker is stored on each wheel and is evaluated against the python
version of the toolchain before selecting the wheel.

The wheel that is selected for each toolchain is unchanged, except for the
python 3.15+ toolchains on the platforms without a platform specific wheel,
which now fall back to the py3-none-any wheel of coverage 7.17.0 instead of
7.10.7.

This prepares for selecting the platform specific wheels for more of the
toolchain platforms.

Work towards #3902

[aignas]

This PR was written by an AI coding agent (Claude Code) under the direction of @aignas, who is responsible for the change and reviews it before merge (semi-autonomous). The agent monitors CI and pushes fixes for CI failures; review comments are handled by the human author, who may use the agent to prepare follow-up changes.

This is an agent-generated comment, posted at the request of the PR author.

[aignas]

PTAL

[rickeylev]

The coverage libs are another thing we should give "provide by default but use user deps is available" treatment to, like we were talking about doing with pip and twine. Something for another PR though

bot review incoming

[aignas]

I rescoped the attached issue to be about that and I have a good idea how we could do it.