It's that RICH header that you need to exclude. I just tested my copy of MSVC 2019, and `/emittoolversioninfo:no` will exclude the RICH header from the binary. Supposedly also works in MSVC 2022.

The build timestamps in the PE header and export table are also a problem as well.

Probably easiest way is to use Bazel to leverage the effort that has gone in there

Well, you can't build MSVS yourself, reproducibly or otherwise, so this is a less appealing endeavor I would think.