Release 3.0

Just starting this because this will need discussion/notes and documentation on breaking changes that we will need to do.

Potentially incompatible changes:
- [ ] #3117 - flip script to `bootstrap`.
- [ ] #2156 - flip venv/site-packages to true.
- [ ] We only support bazel `8` and `9`.
- [ ] We remove `protobuf` aliases and deps.
- [ ] We remove Python 2 support fully.
- [ ] Only support one version of python toolchain per minor version.

Probably out of scope:
- [ ] `experimental_index_url` is enabled by default to all.

Other milestones that I would like to include hit:
- [ ] `pip.default` and `pip.configure` will be stable.
- [ ] `py.lock` files can be read.

I would say we probably should aim for a particular date and whatever is ready is ready at that time.

No files or tests are identified. Start by reviewing the proposed changes in #3117 and #2156, then inspect the release checklist around Bazel support, Python toolchains, pip.default, pip.configure, and py.lock; done means the scope and completion criteria for Release 3.0 are agreed.

Written by the indexing model from the issue text.