dist: Ship siso and cipd CLIs with -help smoke tests

[afq984]

Adds the upstream siso and cipd binaries to //dist so the sandbox can run siso proxy and cipd proxy outside the jail and expose unix sockets inside, letting in-jail Chrome/Android dev tooling reach RBE / fetch CIPD packages without host credentials or network egress.

Both binaries are built from source via rules_go from upstream module versions (siso v1.5.3, luci pinned by pseudo-version) so go.sum hash-locks the entire dep closure. Build wiring:

• bump go_sdk download 1.24.12 → 1.25.7 (siso v1.5.3 needs go ≥ 1.25.7)
• bump go.mod go directive accordingly
• add tools.go (build tag tools) so go mod tidy walks the full siso and cipd CLI dep graph, anchoring transitive deps in go.mod
• gazelle_default_attributes(build_file_generation=clean, proto disable_global) so gazelle regenerates BUILD files for every external module and skips proto-rule generation; without this the hand-written BUILD files in luci-go / remote-apis / reclient/api reference @rules_go and @rules_proto via names that aren't visible in our bzlmod context
• pkg_files in //dist:binaries gains the two new go_binary targets

Smoke tests: dist/dist_test.go's helpSmokeTest extracts the dist tarball and runs <bin> help [-advanced], asserting the output mentions proxy. Catches packaging regressions (missing/wrong-arch binary, dynamic-link breakage) cheaply, without exercising any network path.