test: Tag nested expect_* tests no-sandbox instead of local

[bor-p-s]

Description

A probe for a CI number and a direction; the branch is throwaway.

The nested expect_* tests default to tags = ["local", ...]. Measured here, local does more than drop the sandbox: it also keeps the action out of the shared cache. Buildkite already runs us with --remote_cache=https://storage.googleapis.com/bazel-untrusted-build-cache, which serves the rest of the suite, so these tests re-run on every build.

Over builds 6400 to 6499 the bazel test //... step serves 137 of 190 tests from cache, and the ./test_rules_scala steps serve zero. The tree holds 58 nested tests and 53 of the 190 come back uncached, so the uncached set is essentially them. They also make the test phase serial: Critical Path equals Elapsed, about 19 minutes.

no-sandbox keeps them unsandboxed, which is the part they need, and leaves them eligible for the cache. On 6 nested tests covering all four macro kinds, with two output bases sharing one --disk_cache: 85s on the first run, then all 6 (cached) PASSED in 8.9s.

The open question

These tests declare their own package, MODULE.bazel and the driver as inputs, while the nested bazel reads the whole workspace, so the cache key is narrower than the real dependency. After editing scala/scala.bzl the same tests still came back (cached). That window is open today too, within one output base; this widens it to everything sharing the remote cache.

Closing it and getting CI hits pull against each other: a key covering everything the nested build reads changes with every commit, so every CI build would recompute.

Two ways out. Declare the ruleset sources, which means a filegroup per package since glob stops at package boundaries, so 45 of them. Or make the nested build read a declared copy from runfiles instead of the real tree, which also removes the reason for the shared output base and with it the lock contention that exclusive (#1894) works around. The first is the first half of the second anyway.

Worth agreeing on the direction before spending the 45 filegroups. If CI shows the win is small, the question goes away.