### What does this PR do?
Relands #54887, which #54925 reverted after it broke E2E jobs on `main`.

Recalling that PR: `go_shim` wraps a tool so that `PATH` lookups of `go`
reach Bazel's hermetic SDK, and so that the tool runs from the current
working directory rather than the runfiles tree, superseding
`rules_multitool`'s `cwd()`.
It wraps `gotestsum` and `go_mod_tidy_all`, the latter dropping the
`$(rlocationpath @rules_go//go)` resolution it had grown for itself and
moving to its own package, where the shim taking over
`//:go_mod_tidy_all` leaves its `py_binary` the plain name.

Changed on top of it: `PATH` now holds the Go SDK's own `go`, resolved
through `@rules_go//go:toolchain`, in place of `@rules_go//go`.
The wrapper exports `GOROOT` and sets `GOTOOLCHAIN=local` itself rather
than leaning on `.bazelrc`, and `RUNFILES_DIR` goes away with the
launcher that needed it.

### Motivation
Unbreak `dda inv test` on hosts whose ambient `go` differs from the one
`go.work` requires,
[reported](https://dd.slack.com/archives/C06PBHLD4DQ/p1786618886362859)
by @vitkyrka and followed up by @pgimalac and @hush-hush.
#54107 routed it through `bazel run //internal/tools:gotestsum`,
bringing `gotestsum` under `.bazelrc`'s `--run_env=GOTOOLCHAIN=local`
while it still resolved `go` through `PATH`, so every invocation failed
with `go.work requires go >= 1.26.5` and exporting `GOTOOLCHAIN=auto`
did not help.

That fix then broke `main`, because `@rules_go//go` is a launcher rather
than a `go`: it assigns `cmd.Dir` from `$BUILD_WORKING_DIRECTORY` on
every exec, discarding the directory its caller chose.
`gotest-custom` chooses one per test package, so each prebuilt E2E test
binary ran at the repository root and no longer found its fixtures,
failing on `compose/data`, `usmtest/test_tags.ps1`, `testdataprovision`
and `checks/shared-library/files`.
The SDK's `go` honors its caller, which is the whole of the difference.

### Describe how you validated your changes
On Linux, a child `go` invoked from `test/new-e2e` under the shim
reports that module's `go.mod`, where #54887 reported the repository
root's.
Building a program importing `net/http` through the shim links,
confirming the SDK's sources and tools are reachable.

The reported reproducer still holds: with a stub announcing itself as go
1.24.0 first in `PATH`, tools reach go1.26.5 and never the stub, and
`bazel run //:go_mod_tidy_all -- -diff` exits 0 across every module.

### Additional Notes
Prepending to `PATH` has no declarative spelling: `RunEnvironmentInfo`
carries static strings only, a key given in both `environment` and
`inherited_environment` resolves to the inherited value, and replacing
`PATH` outright would hide `sh`, `cc`, `git` and whatever else the
toolchain reaches for.
Hence a (thin) wrapper reading the environment at runtime.

The runfiles mirror `go_bin_for_host`, rules_go's own definition of a
runnable `go`: the SDK binary plus its headers, libs, sources and tools.

`install_gotestsum` and its per-platform variants keep extracting the
raw binary, the shim being runfiles-bound and those tools driving
pre-built test binaries through `--raw-command`, never resolving `go`.