How do I ensure my preferred version of -mmacosx-version-min "wins"

I need to provide `"-mmacosx-version-min=10.14"` as a compiler flag so I don't get compile failures.
I tried

```
llvm.toolchain(
cxx_standard = {"": "c++23"},
llvm_version = "21.1.6",
extra_cxx_flags = { "darwin-aarch64": ["-mmacosx-version-min=10.14"] },
)
```
as well as `cxx_flags`, but there seems to be a `-mmacosx-version-min=10.11` coming from somewhere that is overriding my preferred version and coming later in the command line arguments. I have an empty `.bazelrc` so it isn't from there. I couldn't find any reference in the repo. I finally settled on

```
#.bazelrc
build --cxxopt=-mmacosx-version-min=10.14
build --linkopt=-mmacosx-version-min=10.14
```

but would rather do this in the toolchain. Where am I going wrong?

Start at the llvm.toolchain configuration and trace how extra_cxx_flags, cxx_flags, and the generated Darwin command line are assembled. Identify the source of the later -mmacosx-version-min=10.11 flag, then verify that the toolchain configuration consistently produces 10.14 for both compilation and linking.

Written by the indexing model from the issue text.