[copybara-service]

Transition OSS Python dependencies and CI builds to hermetic Python.

Open-source builds and CI pipelines previously relied on legacy @pypi_<pkg>//:pkg repository targets, @release_or_nightly workspace rules, and host-installed Python packages (pip install) before invoking Bazel. With the migration to rules_python hermetic Python toolchains, Bazel resolves Python interpreter versions and wheel dependencies directly via requirements.txt lockfiles and @pypi//<pkg>:pkg targets, making host-level package installation and legacy workspace dependencies redundant and error-prone.

Migrate OSS Python dependency rewrites and oss_scripts/pip_package/BUILD targets to @pypi//<pkg>:pkg, remove the obsolete extra_py_deps helper and @org_tensorflow_datasets workspace archive, and declare explicit test dependencies in BUILD targets. Every //third_party/py/absl... dependency maps to the same @pypi//absl_py:pkg, so Copybara keeps the first one in each deps list and reversibly comments out the rest; BUILD files can list all the absl deps they use. Update oss_scripts/configure.sh and py_deps_profile.bzl to persist HERMETIC_PYTHON_VERSION, IS_NIGHTLY, and TF_VERSION into .bazelrc, re-evaluate the repository rule when environment variables change, and pin tensorflow==<TF_VERSION> when re-locking requirements. configure.sh does not re-lock when the lock file already has the requested TF_VERSION, so the committed lock file is not replaced with stale tf-keras or pre-release versions. Presubmit, release, and Docker scripts pass HERMETIC_PYTHON_VERSION instead of managing host virtual environments.

Presubmits use the release lock file by default. Nightly is used only when IS_NIGHTLY=nightly is set (the continuous integration configs set it) or TF_VERSION is a dev version. prepare_tf_dep.sh updates setup.nightly.py for nightly builds and setup.py otherwise, the same file build_pip_package uses. On macOS and Windows, Bazel is installed (source oss_scripts/install_bazel.sh) before configure.sh runs bazel run; configure.sh --fetch_bazel_config_only downloads .bazelversion first.

Additionally, remove the rules_ml_toolchain override from WORKSPACE so the newer version from TF's tf_workspace3() is used, build new deps lists instead of using deps += on default arguments in tftext.bzl.oss, and read only the first line of .bazelversion in run_tests.sh.