Hermetic toolchain tries to use host libraries.

When I try to use the hermetic toolchain I get complication errors that originate from libraries from my host distribution instead of using the hermetic libraries. Am I holding it wrong, or is this a bug?

## Error
The /usr/bin... path is the host library path.
```
clang: warning: CUDA version is newer than the latest partially supported version 12.8 [-Wunknown-cuda-version]
In file included from :1:
/usr/bin/../lib/clang/21/include/__clang_cuda_runtime_wrapper.h:388:10: fatal error: 'texture_fetch_functions.h' file not found
388 | #include "texture_fetch_functions.h"
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~
1 error generated when compiling for sm_52.
Use --verbose_failures to see the command lines of failed build steps.
```

## Reproduction
```shell
git clone https://github.com/bazel-contrib/rules_cuda.git .
cd examples
```

I modified the examples `MODULE.bazel` to point to the latest version of `rules_cude`, and set the redist toolchain.
```diff
diff --git a/examples/MODULE.bazel b/examples/MODULE.bazel
index 0a8becc..47297d7 100644
--- a/examples/MODULE.bazel
+++ b/examples/MODULE.bazel
@@ -4,16 +4,12 @@ module(
compatibility_level = 1,
)

-bazel_dep(name = "rules_cuda", version = "0.2.3")
-local_path_override(
- module_name = "rules_cuda",
- path = "..",
-)
+bazel_dep(name = "rules_cuda", version = "0.3.0")

cuda = use_extension("@rules_cuda//cuda:extensions.bzl", "toolchain")
-cuda.toolkit(
- name = "cuda",
- toolkit_path = "",
+cuda.redist_json(
+ name = "rules_cuda_redist_json",
+ version = "12.6.3",
)
use_repo(cuda, "cuda")
```

Running one of the tests triggers the error.
```shell
bazel test //basic_macros/... --config clang
```

## Host Env
```shell
$ uname -a
Linux phobos 7.0.11-100.fc43.x86_64 #1 SMP PREEMPT_DYNAMIC Mon Jun 1 22:51:40 UTC 2026 x86_64 GNU/Linux
$ bazel --version
bazel 9.1.1
```

Start with examples/MODULE.bazel and the cuda.redist_json configuration, then run bazel test //basic_macros/... --config clang with verbose failures enabled. Trace the command lines and /usr/bin references to determine why the redist toolchain selects host libraries; done means the reproduction builds using the hermetic libraries and the test passes.

Written by the indexing model from the issue text.