Add regression test for sysroot flags on assembly actions

Context

Issue #141 fixed missing --sysroot for assemble/preprocess-assemble actions (fix: sysroot_link_flags feature). The fix shipped without regression coverage because a naive test is unsound.

Why a naive test doesn't work

A .S fixture including a sysroot header (e.g. <features.h>) passes even without --sysroot: the host's /usr/include provides the same glibc (2.39) headers as the autosd10 sysroot, so header resolution alone cannot distinguish sysroot from host fallback — the exact failure mode of #141.

Proposed approach

Assert the resolved command line instead of build success:

• A guardrail-style analysis test (pattern: tests/guardrails/legacy_feature_guard.bzl)
  that resolves the active toolchain and verifies --sysroot=<sysroot> is
  present in the flags for assemble and preprocess-assemble actions, and
  that -Wl,--sysroot is NOT (linker-only flag).
• Alternative: an aquery-based check on a .S target's CppCompile action.

Acceptance criteria

• Test fails when assembly_actions is removed from the sysroot_link_flags feature.
• Test fails if -Wl,--sysroot leaks into assembly actions.
• Runs on Linux x86_64 and aarch64 configs; no target hardware needed.