certs: isolate certificate generation from workspace status

[bplotnick]

(my agent found this during some build optimization work)

Problem

generated_certs currently stamps the certificate-generation action so it can select a year from year_status_key or BUILD_TIMESTAMP. This also makes the action depend on the complete stable workspace status, including unrelated revision or build metadata. Changes to that metadata can regenerate fixtures and invalidate downstream compilation of generated certificate headers even when the selected year and certificate inputs are unchanged.

Change

• Move the existing year-selection logic into a small stamped genrule that writes the selected year to a file.
• Make certificate generation unstamped and consume that year file alongside the existing spec and source inputs.
• Preserve explicit year, custom status keys, timestamp fallback, output labels, runtime filegroups, and header filegroups.
• Update the existing command tests and add analysis coverage proving that only year selection reads workspace status. Explicitly pinned generation has neither status nor year-file inputs.

Validation

• All 10 certificate analysis tests pass locally with Bazel 9.3.0, including the three new action-input tests.
• A standalone consumer fixture loading the modified macro and using a small generator passed four sequential builds: initial year; unrelated stable/volatile metadata change with the same year (generation reused); changed year (generation reran); restored year (original disk-cache output reused). An explicitly pinned fixture remained unchanged throughout.
• Buildifier checks pass for both changed .bzl files; git diff --check passes. The BUILD file retains its existing formatting to avoid unrelated churn.