feat(test-guest): build cacheable QEMU images with Bazel

[drew]

Summary

Make Bazel the build, cache, run, and test entrypoint for disposable QEMU test guests. Nix remains a narrow provider of pinned host tools, while prepared QCOW2 images and deterministic metadata become normal Bazel outputs eligible for local and remote caching.

Related Issue

• Related to feat(build): evaluate Bazel for unified build and test orchestration #2491
• Related to feat: E2E and release testing improvements #2527

Changes

• Add reusable Bzlmod-native test-guest providers, rules, scripts, and host-toolchain wiring under bzl/test-guest
• Keep pinned cloud-image repositories, distro configuration, prepared-image targets, runners, and tests under e2e/test-guest
• Build flattened, sealed, fresh-boot-validated QCOW2 images as declared Bazel outputs
• Consume prepared images from bazel run and bazel test targets using disposable writable overlays
• Accept installable packages and copied guest files as Bazel labels, build them automatically, and transport them through runfiles instead of public host-path flags
• Use a pinned Nix closure only for QEMU, OVMF, Ansible, SSH, and supporting host tools
• Remove the legacy local/OCI image cache, dynamic Nix distro catalog, flake apps, mise task, and standalone E2E dispatcher
• Document the Bazel cache model, reproducibility boundary, supported variants, artifact interface, and modern Bazel contribution guidance

Testing

• mise run pre-commit passes
• mise run test passes
• bazel test //e2e/test-guest:fedora_podman_smoke passes from a cold image build and runs the architecture-matched Bazel-built OpenShell binary in the guest
• Immediate repeat of the Bazel smoke test is served from cache with zero test executions
• Bzlmod lock refresh, Buildifier, Nix expression/flake evaluation, shell syntax, launcher, metadata, and action-graph checks pass

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)