manifest/bazel: nested-workspace + Bazel-native Maven extraction

[Simon (simonhj)]

Summary

Rewrites socket manifest bazel's Maven extraction pipeline so it (a)
discovers every workspace under the scan root, not just cwd, and (b)
relies on Bazel-native commands for repo enumeration instead of static
Starlark regex parsing.

1. Walk the scan root for every workspace (MODULE.bazel / WORKSPACE /
   WORKSPACE.bazel). Caller-supplied prune policy.
2. Per workspace, discover Maven hubs:
   - Bzlmod: bazel mod show_extension @rules_jvm_external//:extensions.bzl%maven
   - WORKSPACE: probe conventional names (@maven, @maven_install,
     @maven_dev, @unpinned_maven, @maven_unpinned). Tri-state
     classifier (populated / empty / not-defined).
3. Per populated candidate, run per-repo metadata cquery:
     attr("tags", "\bmaven_coordinates=", @<repo>//...)
     ∪ attr("maven_coordinates", ".+", @<repo>//...)
     ∪ attr("maven_url", ".+", @<repo>//...)
   --output=jsonproto --keep_going
4. Aggregate across all workspaces; dedup by full Maven coordinate.
5. Write synthesized maven_install.json plus sidecar
   manifest-status.json with per-repo status entries.

Server isolation

Every Bazel invocation runs under a per-CLI-call
--output_user_root=<tempdir>. On per-repo cquery timeout the
orchestrator reaps the server (bazel shutdown) and rm -rfs the
tempdir, then mints a fresh one for subsequent repos. The
finally-block cleans up every tempdir that was minted. A single
hostile repository_rule no longer cascades into the rest of the run.

New modules

• bazel-workspace-walk.mts — pure-function workspace walker with
  injected prune policy (ignoreDirNames, ignoreDirPrefixes).
  MAX_WALK_DEPTH = 8 (corpus survey: deepest realistic application
  layout is 7; bazel-self test fixtures hit 9). The orchestrator
  composes the codebase-wide IGNORED_DIRS from src/utils/glob.mts
  with Bazel-specific extras (bazel-*, dist*,
  .socket-auto-manifest, plus VCS/IDE dirs).
• bazel-cquery.mts — per-repo metadata cquery + defensive
  jsonproto parser (dispatches on attribute[].type; accepts both
  camelCase stringValue/stringListValue and snake_case
  string_value/string_list_value; tolerates Bazel 5+ envelope and
  older per-line streamed shapes).

Rewritten modules

• bazel-repo-discovery.mts — drops the entire Starlark regex
  parser (USE_REPO_RE, MAVEN_INSTALL_NAME_RE,
  parseMavenRepoCandidates, listLegacyStarlarkFiles,
  safeReadFile, parseVisibleRepoCandidates, validateMavenRepo,
  discoverMavenRepos). New primitives: parseShowExtensionOutput,
  classifyProbeResult, probeCandidate, CONVENTIONAL_MAVEN_REPO_NAMES.
• bazel-query-runner.mts — centralises startup-flag construction
  (--bazelrc / --output_user_root / --output_base). Drops
  buildProbeFor (kind-only probe). Adds
  runBazelModShowMavenExtension and buildMavenProbeFor
  (lightweight presence-check cquery feeding the tri-state
  classifier). parseVisibleRepoCandidates moved to
  bazel-pypi-discovery.mts (its only remaining consumer).
• extract_bazel_to_maven.mts — wraps the per-workspace algorithm
  in a tree walk. Drops the unsorted_deps.json fast path (the
  metadata cquery returns the same GAVs without depending on
  bazel-out symlinks or generated artefacts) and the lockfile
  merge-back loop (server walker handles it).

Sidecar shape

.socket-auto-manifest/manifest-status.json:

{
  "complete": true,
  "workspaces": [
    {
      "relPath": "",
      "mode": { "bzlmod": true, "workspace": false },
      "repos": [
        { "name": "maven", "status": "ok",      "artifactCount": 118, "durationMs": 28213 },
        { "name": "maven_dev", "status": "empty", "artifactCount": 0,   "durationMs": 102 }
      ]
    }
  ]
}

complete: false fires iff any repo timed out.