Keep local Bazel cache uploads read only by default

.bazelrc

@@ -1,3 +1,5 @@
+try-import %workspace%/user.bazelrc
+
 common --repo_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
 common --repo_env=BAZEL_NO_APPLE_CPP_TOOLCHAIN=1
 # Dummy xcode config so we don't need to build xcode_locator in repo rule.
@@ -38,6 +40,11 @@ common --test_output=errors
 common --bes_results_url=https://app.buildbuddy.io/invocation/
 common --bes_backend=grpcs://remote.buildbuddy.io
 common --remote_cache=grpcs://remote.buildbuddy.io
+# Per-user auth can be added in `user.bazelrc` without checking credentials
+# into the repo. For open-source-safe defaults, local builds stay read-only.
+# Keep local developers on shared cache reads, but avoid publishing
+# machine-specific local outputs into the shared cache by default.
+common --noremote_upload_local_results
 common --remote_download_toplevel
 common --nobuild_runfile_links
 common --remote_timeout=3600
@@ -53,6 +60,7 @@ common --jobs=30
 
 common:remote --extra_execution_platforms=//:rbe
 common:remote --remote_executor=grpcs://remote.buildbuddy.io
+common:remote --remote_upload_local_results
 common:remote --jobs=800
 # TODO(team): Evaluate if this actually helps, zbarsky is not sure, everything seems bottlenecked on `core` either way.
 # Enable pipelined compilation since we are not bound by local CPU count.

.gitignore

@@ -33,6 +33,7 @@ result
 CLAUDE.md
 .claude/
 AGENTS.override.md
+user.bazelrc
 
 # caches
 .cache/
@@ -91,4 +92,3 @@ CHANGELOG.ignore.md
 # Python bytecode files
 __pycache__/
 *.pyc
-