bug(rules/compilepkg): cgo2 is invoked _twice_ when using coverage instrumentation

### What version of rules_go are you using?

upstream release-0.46 (https://github.com/cockroachdb/rules_go/commits/release-0.46/) plus a few patches

### What version of gazelle are you using?

v0.33.0-0-g061cc37

### What version of Bazel are you using?

7.2.1

### Does this issue reproduce with the latest releases of all the above?

Yes.

### What operating system and processor architecture are you using?

Linux x86_64

### Any other potentially useful information about your toolchain?

### What did you do?

Attempted to build a Go package (from [CockroachDB](https://github.com/cockroachdb/cockroach)) with coverage instrumentation,

```
bazel build //pkg/build:build --config=ci -c opt --collect_code_coverage
```

The build failed due to `nogo`,

```
compilepkg: nogo: errors found by nogo during build-time code analysis:
/tmp/rules_go_work-2407553143/cgo/github.com/cockroachdb/cockroach/pkg/build/info.pb_1.go:276:17: unnecessary conversion (unconvert)
```

Removing `--collect_code_coverage` from the above yields a successful build,

```
bazel build //pkg/build:build --config=ci -c opt
...
INFO: Build completed successfully, 64 total actions
```

### What did you expect to see?

I expected the build to succeed when using `--collect_code_coverage`.

### What did you see instead?

Instead, the build failed for a rather obscure reason (see below).

Start by reproducing `bazel build //pkg/build:build --config=ci -c opt --collect_code_coverage` on Linux x86_64, then inspect the `rules/compilepkg` path named in the title and its cgo handling. Compare the coverage and non-coverage builds; done means the coverage-instrumented build succeeds without the duplicate cgo2 invocation or resulting nogo error.

Written by the indexing model from the issue text.