chore(deps): follow mbo — Bazel 9 + hermetic LLVM 20.1.8, drop WORKSPACE, bump deps

[helly25]

Mirrors helly25/mbo's build/CI/compiler infrastructure into proto and updates all dependencies.

Compiler ("use it for compiler")

• toolchains_llvm 1.8.0 — first release containing PR osx: sanitizer runtime via dynamic_runtime_lib + @loader_path rpath (fixes #192) bazel-contrib/toolchains_llvm#769 (macOS asan @loader_path rpath fix), so no git_override is needed (mbo still pins the commit).
• LLVM 20.1.8 default with extra_llvm_distributions adding 21.1.8 / 22.1.7 rungs.
• No register_toolchains; the hermetic clang toolchain is registered only under --config=clang via --extra_toolchains (Bazel 9 always resolves cc toolchains).
• Added tools/show_compiler.cc + tools/run_under_symbolizer.sh.in and the //:is_clang config_setting.

Dependencies

• bazel_skylib 1.9.0, platforms 1.1.0, rules_cc 0.2.19, +rules_shell 0.8.0, abseil 20250814.2, re2 2025-11-05.bcr.1, googletest 1.17.0.bcr.2, hedron → helly25 fork (75ba4c31), dwyu 0.16.0. Dropped explicit rules_python (transitive via protobuf).
• protobuf default 30.0 → 34.1 — a conservative pin one release behind the newest (35.x); the full supported range [32, 33, 34, 35] is exercised by the proto_version CI matrix.

protobuf transitive-toolchain fixes for Bazel 9 (proto builds none of these)

• rules_go 0.61.0 MVS shim: protobuf pulls an old rules_go whose go_toolchains fail to load after rules_cc 0.2.x removed CcInfo.
• --repo_env=ANDROID_HOME= in .bazelrc: protobuf pulls rules_android, which registers @androidsdk//:all; on a runner with an Android SDK (e.g. GitHub ubuntu) that repo instantiates and rules_android's attrs.bzl fails to compile on Bazel 9. Blanking ANDROID_HOME for repo rules keeps it dormant.

Build system

• Dropped WORKSPACE support (deleted WORKSPACE, workspace.bzl, bzl/); .bazelversion → 9.1.1; .bazelrc rewritten to mbo style (--noenable_workspace, generic external/.*@-Wno-error, symbolizer/asan blocks).
• Minimum Bazel is now 8.x (was 7.2.1): protobuf 34.1 no longer analyzes on Bazel 7.x (verified — 7.2.1 fails, 8.7.0/9.1.1 pass).

CI

• Removed the bazelmod/MODULE.protoXX.bazel swap mechanism; the protobuf version is now a single-line sed rewrite of MODULE.bazel — no module-include swapping.
• main.yml/test.yml: bazel_version matrix (8.7.0/9.0.2/9.1.1), proto_version matrix (32.1/33.6/34.1/35.0), a show_compiler assertion gate, Node 24 actions; kept the yq done-gate self-check.
• BCR patches now comment the dev/llvm includes only (no dep downgrade); presubmit.yml bazel matrix → [8.x, 9.x]; release_prep.sh drops the WORKSPACE snippet.
• pre-commit shellcheck: koalaman (Docker) → shellcheck-py (matches mbo; runs without Docker).

Source fixes for newer protobuf

• file.cc checks the now-[[nodiscard]] SerializeToOstream return value.
• Migrated SilentErrorCollector (+ its test) to protobuf's RecordError/RecordWarning API and dropped the dead pre-v26 AddError/AddWarning branch. protobuf 35 removed those deprecated virtuals, and the old #if GOOGLE_PROTOBUF_VERSION guard also misfired on v35 because its tokenizer.h no longer defines that macro.
• Two EXPECT_DEATH locals marked [[maybe_unused]].

CHANGELOG

Notes added under the upcoming 1.2.1 (already the version in MODULE.bazel, so no bump; compare-versions stays green).

Validation

Local (macOS arm64): default + --config=clang build and all 4 tests pass for protobuf 34.1 (default) and 35.0, including with ANDROID_HOME set (reproducing the CI runner env); analysis passes on Bazel 8.7.0 and 9.1.1; pre-commit fully green (shellcheck included). CI is green on the PR.

Heads-up: this is breaking for downstream — WORKSPACE consumers and anyone on Bazel < 8 must migrate to bzlmod / Bazel 8+.