if I can't download subsystem tools from the internet, is there a way to package them in the repo manually? Or specify an alternate URL

Yes, see https://www.pantsbuild.org/v2.11/docs/restricted-internet-access#customizing-tool-download-locations

you guys have thought of everything

you guys

if you mean w/ that == overall community, not only core maintainers 👖 many thanks to @wooden-thailand-8386 for both the idea and adding this last year!

I'm glad it was useful for someone else as well :))