Older release branches need reusable sysroots from master-built remote execution images. Extend update_remote_execution_containers to publish a header/library archive for every built architecture to s3://mdb-build-public/rbe-sysroots/. Filenames include the full archive SHA-256, so rebuilds preserve URLs pinned by older releases.

remote_execution_containers_generator.py creates reproducible archives from the existing sysroot path allowlist, normalizes directory modes and metadata across publisher umasks, makes absolute library symlinks relative, and records sysroot-<architecture>url and sysroot<architecture>sha256 alongside the container digest only after all requested uploads for that distro succeed. Evergreen patch runs use -sysroot-dry-run to extract and hash sysroots and print proposed pins without uploading archives or using S3 credentials. Production runs use the public-build S3 credentials separately from the ECR role. bazel/docs/rbe_images.md documents the archive layout and publication options.

Validation: 38 generator and PR-script unit tests pass, covering archive contents, symlinks, hard links, stable hashes across timestamps and umasks, architecture selection, credential isolation, cleanup, preservation of existing pins after failed uploads, and the Evergreen script's patch/production dry-run handling. The generator's Bazel test target also passes. bazel run format, Ruff, shell syntax, and Evergreen YAML checks pass. A live container rebuild and S3 upload have not been run.