@bazel_tools//tools/sh:local_sh_toolchain is missing any constraints to make it local

`@bazel_tools//tools/sh:sh_configure` is a repo rule that detects and configures `sh_toolchain` (path to `bash`), by querying the local host.

The guts of the generated repo rule are:
https://github.com/bazelbuild/bazel/blob/0f760395e04cb0accb912be128b4f363663e8d30/tools/sh/sh_configure.bzl#L59-L69

I think this needs at least `exec_compatible_with = HOST_CONSTRAINTS` or else this path will incorrectly be used on other exec platforms. (HOST_CONSTRAINTS isn't specific enough, but it's the best we've got.)

Read tools/sh/sh_configure.bzl at lines 59-69, where the generated repository rule configures the sh_toolchain from the local bash path. Check how exec_compatible_with and HOST_CONSTRAINTS are used in nearby toolchain definitions. Done means the generated local_sh_toolchain is restricted to the host-compatible execution platform rather than being selected elsewhere.

Written by the indexing model from the issue text.