tools/test/test-setup.sh is non-hermetic

### Description of the bug:

When writing files to `$TEST_UNDECLARED_OUTPUTS_DIR`, [`test-setup.sh`](tools/test/test-setup.sh) requires the `file` and `zip` tools to be installed on the RBE runners itself. Since 7a183118187a8a799f2c23d935d3330e33527604 the build fails if these tools are not available. This violates hermeticity. `@bazel_tools` should provide all necessary functionality it needs in a hermetic way.

### Which category does this issue belong to?

_No response_

### What's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

Use an `sh_test` with the following script:
```starlark
#!/bin/bash
touch "${TEST_UNDECLARED_OUTPUTS_DIR}/undeclared-output.txt"
```

and run it with Bazel 7.4+ on an RBE runner with out `file` and `zip` tools available (for example a plain `debian:12` image from Docker Hub).

### Which operating system are you running Bazel on?

Linux

### What is the output of `bazel info release`?

7.4.1

### If `bazel info release` returns `development version` or `(@non-git)`, tell us how you built Bazel.

_No response_

### What's the output of `git remote get-url origin; git rev-parse HEAD` ?

_No response_

### If this is a regression, please try to identify the Bazel commit where the bug was introduced with bazelisk --bisect.

The functionality never worked and starting from 7a183118187a8a799f2c23d935d3330e33527604 (@tjgq FYI) it is a hard error.

### Have you found anything relevant by searching the web?

_No response_

### Any other information, logs, or outputs that you want to share?

_No response_

Start with tools/test/test-setup.sh and reproduce the sh_test on a Debian 12 RBE runner without file or zip installed. Trace how undeclared outputs are packaged and identify the @bazel_tools functionality involved. Done means the test setup no longer depends on host-provided file or zip tools and the reproduction succeeds on the minimal runner.

Written by the indexing model from the issue text.