Problem

The Evergreen Bazel build wrapper can enable release configurations while running on a regular Evergreen distro. During review of mongo PR #63636, s390x release compilation was moved to ARM64 builders, but the assignments used regular distros despite equivalent release distros being available. Add a runtime check to catch this configuration mistake before compilation.

Proposed change

Add a shared check to evergreen/bazel_compile.sh and the appropriate wrapper helpers.

• Determine whether the invocation uses public-release, public-release-local, or public-release-rbe after composing its build options, including automatically selected release flags.
• In Evergreen, require the actual task's distro_id to identify a release distro using the existing release- convention.
• Fail with a nonzero exit status before invoking the build if a release profile is enabled on a non-release distro or the Evergreen distro cannot be verified.
• Report the selected release configuration and actual distro ID, and tell the user to assign the task or task group to a suitable release distro.
• Apply the check to native and cross builds, including patch runs that enable release configurations.
• Base the check on the release profiles and actual executing distro, rather than the variant's name or default host assignment.
• Preserve non-release builds and local invocations outside Evergreen. Keep code-generation options such as release=True distinct from release publication profiles where they do not imply the same execution policy.

Acceptance criteria

• All three release profiles succeed on release-* Evergreen distros and fail on regular distros before compilation starts.
• Non-release builds on regular distros continue to succeed.
• Tests cover both -config=name and -config name, multiple profiles, flags added by maybe_release_flag, and flags supplied through task/variant arguments.
• Profiles inherited through Bazel rc configuration aliases do not bypass the check.
• Missing or empty distro_id in an Evergreen release invocation produces a clear failure; local builds without Evergreen context remain usable.
• Wrapper tests confirm that rejected invocations never start a Bazel build.

Examples

• --config=public-release-local on rhel93-arm64-m8g-4xlarge: reject.
• --config=public-release-local on release-rhel93-arm64-m8g-4xlarge: allow.
• --config=evg without release profiles on rhel93-arm64-m8g-4xlarge: allow.

Related code

• evergreen/bazel_compile.sh: assembles final flags and invokes Bazel.
• evergreen/bazel_evergreen_shutils.sh: maybe_release_flag selects release profiles.
• .bazelrc: defines release profiles.
• evergreen/bazel_evergreen_shutils_test.sh: wrapper test coverage.

Related work: SERVER-136176.