Update strict action env comment

.buildkite/bindists-pipeline

@@ -9,8 +9,8 @@ BAZEL_DIR="$(.buildkite/fetch-bazel-bindist)"
 trap "rm -rf '$BAZEL_DIR'" EXIT
 export PATH="$BAZEL_DIR:$PATH"
 echo "common:ci --build_tag_filters -requires_lz4,-requires_proto,-requires_zlib,-requires_doctest,-requires_c2hs,-requires_threaded_rts,-dont_test_with_bindist" > .bazelrc.local
-# XXX: Remove once all rules using `use_default_shell_env = True` have been
-#   converted to using `rules_sh`'s POSIX toolchain.
+# XXX: @com_google_protobuf sets `use_default_shell_env = True`, so we enable
+#   strict action env to avoid changes in `PATH` invalidating the cache.
 echo "build:ci --experimental_strict_action_env" >> .bazelrc.local
 ./tests/run-start-script.sh --use-bindists
 bazel build --config ci //tests/...