1. 1. Summary

If the Linux build container services are unusable, the wrapper hook now falls back to a native, non-containerized build instead of failing closed.

Previously, `run_hermetic_container` in `bazel/wrapper_hook/hermetic_container_integration.py` returned exit code 1 (`refusing to run build tools natively`) on a supported Linux host when any of these failed:

• `_select_linux_container_runtime` found no usable Docker/Podman runtime
• `_ensure_linux_container_image` could not pull the pinned build container image
• `_ensure_linux_action_container` failed the persistent action container's start/preflight checks (e.g. the writable-mount probe or `does not have usable Bazel bind mounts` errors)

Each site now warns via `_warn_native_fallback` (including the runtime's error detail) and runs Bazel natively through the new `_run_linux_native_fallback` helper, which mirrors DIRECT mode, including publishing the native shared-install symlink. The fallback is Linux-only: Windows and macOS cross-host routing is unchanged. `MONGO_BAZEL_USE_HERMETIC_CONTAINER=0` and `MONGO_LINUX_CONTAINER_ACTIONS=0` keep their existing meaning as explicit opt-outs.

`bazel/docs/linux_hermetic_container_cross_rbe.md` is updated to document the fallback.

1. 1. Testing

• `bazel.wrapper_hook.hermetic_container_integration_test`: all 199 tests pass. The three fail-closed tests now assert the native fallback (`test_missing_docker_falls_back_to_native_build`, `test_image_pull_failure_falls_back_to_native_build`, `test_container_start_failure_falls_back_to_native_build`).
• `bazel run //:format` passes.