Bazel sends host's PATH to remote executor

### Description of the bug:

Even with the strict action env, the PATH that gets sent to a remote action can be very incorrect. For example, when running on a Windows host and a linux executor, I see `PATH=C:\Program Files\Git\usr\bin;C:\Program Files\Git\bin;C:\Windows;C:\Windows\System32;C:\Windows\System32\WindowsPowerShell\v1.0`.

This results in bash scripts being unable to execute shebangs such as `#!/usr/bin/env bash` as there is no `bash` in the (nonsense) PATH

### Which category does this issue belong to?

_No response_

### What's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

_No response_

### Which operating system are you running Bazel on?

_No response_

### What is the output of `bazel info release`?

_No response_

### If `bazel info release` returns `development version` or `(@non-git)`, tell us how you built Bazel.

_No response_

### What's the output of `git remote get-url origin; git rev-parse HEAD` ?

```text

```

### If this is a regression, please try to identify the Bazel commit where the bug was introduced with bazelisk --bisect.

_No response_

### Have you found anything relevant by searching the web?

_No response_

### Any other information, logs, or outputs that you want to share?

cc @fmeum

No source file or test is identified. Start by reproducing the Windows-host/Linux-remote-executor case with strict action environment enabled, then trace how PATH is propagated to remote actions. Done means remote actions receive an executor-appropriate PATH and bash shebangs work; add a regression test for the behavior.

Written by the indexing model from the issue text.