Currently the Bazel compiler wrapper hides arguments by default, ex:

external/local_config_cc/cc_wrapper.sh -U_FORTIFY_SOURCE -fstack-protector -Wall -Wthread-safety -Wself-assign -Wunused-but-set-parameter -Wno-free-nonheap-object -fcolor-diagnostics ... (remaining 76 arguments skipped)

To help debug what went wrong, we should setup Bazel to automatically print out the full command line string. This involves either switching away from Bazel's cc_wrapper somehow (maybe by depending on less of the default toolchain?) or by calling aquery after a Bazel execution fails via a `tools/bazel` hook to analyze the failure and print out the effective compiler/linker command that was used.