ci: add daily buildifier formatting cron that opens a PR on changes

[tinder-maxwellelliott]

What

Adds a second daily formatting cron — this one runs buildifier over all Starlark/BUILD files and opens a PR only when it produced changes. Complements the ktfmt cron added in #373.

How

• New target //cli/format:buildifier — a format_multirun configured with starlark = "@buildifier_prebuilt//:buildifier", backed by a new buildifier_prebuilt dev dependency. Kept separate from the kotlin //cli/format target so the two crons never reformat each other's files.
• New workflow .github/workflows/buildifier.yaml — daily at 12:30 UTC (between the ktfmt and coverage-badge crons), plus a workflow_dispatch button. Reuses the established rolling-PR pattern: force-pushes a bot-owned ci/buildifier-format branch and reuses the open PR if one exists. Never touches master directly.
• Test fixtures excluded via a new .gitattributes marking cli/src/test/resources/** as rules-lint-ignored. Those workspaces are deliberately-constructed E2E inputs (e.g. module_bazel_comment exercises comment preservation, cquery_failing_target encodes a failure scenario) — formatting them would corrupt the very thing under test. No Kotlin lives there, so this only affects buildifier.
• Lock-churn guard (both crons): runs are now pinned to the repo's .bazelversion (dropped the explicit USE_BAZEL_VERSION: 9.x) and pass --lockfile_mode=off, so MODULE.bazel.lock is never rewritten mid-run. This keeps the generated formatting PRs limited to formatting-only changes.

Notes

• MODULE.bazel.lock churn here is the legitimate result of promoting buildifier_prebuilt to a direct dep (8.5.1.2); the old 6.4.0 download-extension specs are no longer used.
• The first cron run will format cli/BUILD, proto/BUILD, and tools/BUILD (already flagged by buildifier.check) and open a PR for them — intentionally left out of this infra PR to keep the diff focused.
• schedule triggers only activate once this lands on master.

Verified locally: bazel run //cli/format:buildifier.check --lockfile_mode=off flags exactly the 3 real BUILD files, skips all fixtures, and leaves MODULE.bazel.lock untouched.

🤖 Generated with Claude Code