Hermetic toolchains and live-reload dev servers usually fight each other: the build tool wants inputs in a sandbox, the dev server wants to watch the files you are editing.

The trick is to split the two jobs:

• bazel build //web:dist runs the build inside the sandbox and produces a fully reproducible artifact in bazel-out.
• bazel run //tools/env:dev only borrows the pinned binaries from Bazel, but runs astro dev against the real source tree, so hot module replacement sees your edits.

Bazel owns the toolchain; Astro owns the dev loop.